CRISC Risk Response and Mitigation Practice Question
A retail company has identified that its point-of-sale (POS) terminals are running an outdated operating system that no longer receives security patches. The risk practitioner recommends upgrading the terminals to a supported OS. The cost of the upgrade is $500,000, while the estimated annual loss from a potential breach is $2,000,000 with a 30% likelihood. Which risk response strategy is being recommended?
⚠ Common exam trap
Many candidates confuse mitigation with avoidance or transfer. Mitigation reduces risk through controls, while avoidance eliminates the activity and transfer shifts financial impact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk mitigation
Upgrading the POS terminals to a supported operating system is a mitigation strategy because it reduces the likelihood of a breach by addressing the unpatched vulnerability. The cost-benefit analysis ($500,000 upgrade vs. $600,000 expected annual loss) supports this action. Mitigation is appropriate when controls can reduce risk to an acceptable level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk avoidance
Why it's wrong here
Risk avoidance means eliminating the risk by discontinuing the activity that causes it. Upgrading the OS does not avoid the risk; it mitigates it. Avoidance would involve ceasing to use POS terminals altogether, which is not practical for a retail company. The recommendation is to improve security, not to stop the business activity.
- ✗
Risk acceptance
Why it's wrong here
Risk acceptance means acknowledging the risk and deciding to proceed without implementing additional controls. Here, the company is taking action to upgrade the terminals, which is not acceptance. Acceptance would involve keeping the outdated OS and documenting the decision to live with the risk, which is not what is being recommended.
- ✓
Risk mitigation
Why this is correct
Risk mitigation involves implementing controls to reduce the likelihood or impact of a risk. Upgrading the POS terminals to a supported OS reduces the likelihood of exploitation of unpatched vulnerabilities. This is a classic example of mitigation, as the action directly addresses the vulnerability and lowers the risk to an acceptable level.
- ✗
Risk transfer
Why it's wrong here
Risk transfer involves shifting the financial impact of a risk to a third party, such as through insurance. Upgrading the POS terminals does not transfer risk; it reduces it directly. Transfer would be relevant if the company purchased insurance to cover breach costs, but that is not the recommended action here.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.