CRISC Risk Response and Mitigation Practice Question
A third-party vendor's security assessment reveals multiple high-risk findings related to data handling. The vendor is unwilling to remediate, citing cost. The vendor contract includes a clause that requires adherence to security standards. The organization's risk appetite for third-party risk is low. What is the most appropriate risk response?
⚠ Common exam trap
Many candidates choose mitigation (reducing data shared) because it seems like a compromise, but they overlook that the vendor's core data handling processes remain insecure, and the organization's low risk appetite demands complete elimination of the risk, not partial reduction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Avoid by terminating the contract
The vendor's refusal to remediate high-risk findings directly violates the contract's security standards clause, and the organization's low risk appetite for third-party risk means that accepting or mitigating the residual risk is unacceptable. Terminating the contract (avoidance) is the only response that eliminates the risk entirely, aligning with the principle that when a third party cannot or will not meet required security controls, the relationship should be severed to prevent potential data breaches or compliance violations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Avoid by terminating the contract
Why this is correct
Termination eliminates the risk.
- ✗
Mitigate by reducing data shared
Why it's wrong here
Partial mitigation may not satisfy low appetite.
- ✗
Transfer via insurance
Why it's wrong here
Insurance covers losses but does not prevent the risk.
- ✗
Accept the risk and monitor
Why it's wrong here
Acceptance violates the low risk appetite.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A risk assessment identifies that a legacy system has a high risk of failure with no available vendor support. The organization decides to decommission the system and migrate to a modern platform. This is:
hard- ✓ A.Risk Avoidance
- B.Risk Transfer
- C.Risk Mitigation
- D.Risk Acceptance
Why A: Decommissioning the legacy system and migrating to a modern platform eliminates the risk entirely by removing the vulnerable asset from the environment. This is the definition of risk avoidance, as the organization chooses not to engage with the risk at all rather than reducing or transferring it. The decision directly addresses the high risk of failure and lack of vendor support by removing the system from operation.
Variation 2. Which TWO of the following are examples of risk avoidance? (Select TWO.)
medium- A.Accepting the risk
- B.Installing a firewall
- ✓ C.Deciding not to enter a new market
- D.Purchasing insurance
- ✓ E.Discontinuing a risky product line
Why C: Risk avoidance involves taking action to eliminate the risk entirely by not engaging in the activity that introduces it. Option C, 'Deciding not to enter a new market,' avoids all associated market, regulatory, and competitive risks by simply not pursuing that business opportunity. Option E, 'Discontinuing a risky product line,' removes the risk by ceasing the activity that generates it, such as halting production of a product with known safety or compliance issues.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.