CRISC Risk Response and Mitigation Practice Question
A multinational corporation has a risk register entry for a supplier that provides critical components. The supplier has a history of financial instability, and the risk of supply chain disruption is high. The risk owner decides to dual-source the components from a second supplier. Which risk response strategy does this represent, and what is the primary benefit?
⚠ Common exam trap
Many exam-takers confuse dual-sourcing with risk transfer because a second supplier is involved, but the risk is not shifted financially.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk mitigation, because it reduces the likelihood of disruption
Dual-sourcing is a risk mitigation technique that reduces the likelihood of supply chain disruption by providing an alternative source. It does not transfer, avoid, or accept the risk; it actively reduces it. The primary benefit is increased resilience and reduced dependency on a single supplier.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk transfer, because the risk is shared with the second supplier
Why it's wrong here
Dual-sourcing does not transfer risk to the second supplier; it reduces the organization's dependency on a single supplier. Risk transfer would involve shifting the financial impact, such as through insurance. Here, the organization retains the risk but mitigates it by diversifying sources, so this is not transfer.
- ✗
Risk avoidance, because the organization avoids relying on a single supplier
Why it's wrong here
Risk avoidance would mean eliminating the need for the components or discontinuing the product. Dual-sourcing does not avoid the risk; it manages it by having a backup. The organization still depends on suppliers, so the risk is not avoided but rather reduced through redundancy.
- ✗
Risk acceptance, because the organization accepts the supplier risk but adds a backup
Why it's wrong here
Risk acceptance means taking no action to reduce the risk. Adding a second supplier is a deliberate action to reduce the risk, so it is not acceptance. Acceptance would be appropriate only if the organization decided to do nothing and absorb any consequences, which is not the case here.
- ✓
Risk mitigation, because it reduces the likelihood of disruption
Why this is correct
Dual-sourcing is a mitigation strategy that reduces the likelihood and impact of a supply chain disruption by ensuring an alternative source is available. It does not eliminate the risk but lowers the probability of a total shutdown if one supplier fails. This is a classic example of risk mitigation through redundancy and diversification.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.