CRISC Risk Response and Mitigation Practice Question
A retail company's risk register shows that a point-of-sale system vulnerability has a high likelihood and high impact. The IT team proposes applying a vendor patch, but the patch has not been tested with the custom payment application. Which risk response strategy is being considered?
⚠ Common exam trap
It's easy for candidates to confuse mitigation with acceptance because the patch is untested, but the intent to reduce risk through a control defines mitigation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk mitigation
The IT team is proposing a patch to reduce the likelihood of exploitation, which is a mitigation response. Mitigation is the appropriate strategy when an organization chooses to implement controls to lower risk rather than accept, transfer, or avoid it. The untested patch introduces a secondary risk that must be managed, but the primary response strategy remains mitigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk transfer
Why it's wrong here
Transfer shifts the financial consequence of a risk to a third party, typically through insurance or contracts. Patching a system does not transfer risk; it reduces it directly. The scenario describes an internal technical action, not an insurance policy or contractual arrangement, so transfer is not the strategy being considered.
- ✗
Risk acceptance
Why it's wrong here
Acceptance means acknowledging the risk and taking no action to reduce it. Here, the IT team is actively proposing a patch, which is an attempt to reduce the risk. Acceptance would be appropriate only if the company decided the risk was tolerable and chose not to patch, which is not what is described in the scenario.
- ✓
Risk mitigation
Why this is correct
Mitigation involves implementing controls to reduce the likelihood or impact of a risk. Applying a vendor patch directly reduces the likelihood of exploitation of the POS vulnerability. The fact that the patch is untested with the custom application introduces a new risk, but the intended response strategy remains mitigation because the goal is to lower the original risk.
- ✗
Risk avoidance
Why it's wrong here
Avoidance means eliminating the activity or process that generates the risk. The company is not proposing to stop using the POS system; it is proposing to patch it. Avoidance would involve discontinuing the payment application entirely, which is not described and would be impractical for a retailer.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.