CRISC Risk Response and Mitigation Practice Question
A software development company is launching a new mobile application that will collect user location data. The risk manager identifies that the data collection could violate privacy regulations if not properly disclosed. The legal team recommends updating the privacy policy and obtaining explicit user consent. Which risk response strategy is this?
⚠ Common exam trap
The trap here is thinking that compliance actions are avoidance because they follow regulations, but they are actually mitigation since the risky activity continues with added controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk mitigation
By updating the privacy policy and obtaining explicit consent, the company is implementing controls to reduce the likelihood of privacy violations. This is a mitigation strategy because it addresses the risk directly through compliance measures. Avoidance would mean not collecting data, transfer would involve shifting liability, and acceptance would mean doing nothing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk avoidance
Why it's wrong here
Risk avoidance would mean not collecting location data at all to eliminate the risk of privacy violations. The company is proceeding with data collection but adding disclosures and consent, which does not avoid the risk. Instead, it reduces the likelihood of regulatory penalties by complying with laws, so it is not avoidance.
- ✗
Risk transfer
Why it's wrong here
Risk transfer involves shifting the financial or legal consequences to another party, such as through insurance or outsourcing. Here, the company is not transferring the risk; it is directly managing it by implementing compliance measures. The legal team's recommendations are internal controls, not a transfer mechanism, so this is not transfer.
- ✗
Risk acceptance
Why it's wrong here
Risk acceptance would mean acknowledging the privacy risk and taking no action to reduce it, potentially hoping that penalties do not occur. The company is taking proactive steps to comply with regulations, which is the opposite of acceptance. Acceptance is passive, while this scenario involves active risk reduction.
- ✓
Risk mitigation
Why this is correct
Updating the privacy policy and obtaining explicit consent are controls that reduce the likelihood of privacy violations and regulatory fines. These actions mitigate the risk by ensuring transparency and user agreement, aligning with legal requirements. Therefore, this is a risk mitigation strategy, as the company is actively reducing the risk's potential impact.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.