CRISC Risk Response and Reporting Practice Question
An e-commerce company discovers that a third-party payment processor suffered a breach exposing customer card data. The processor contract includes a clause requiring the vendor to indemnify the company for breach-related costs. The risk owner updates the register to show that financial loss from this vendor risk is now borne by the processor. Which risk response strategy has been applied?
⚠ Common exam trap
A common mix-up: candidates confuse contractual risk transfer with mitigation, because both involve doing something about the risk; transfer shifts financial consequence while mitigation reduces likelihood or impact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk transfer
An indemnification clause that makes the payment processor bear breach-related costs shifts the financial consequence of the risk to a third party, which is risk transfer. The breach risk itself and reputational exposure remain with the company, but the monetary loss is contractually reassigned. Mitigation, avoidance, and acceptance do not describe a contractual shifting of financial responsibility, so transfer is the correct classification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk acceptance
Why it's wrong here
Acceptance means retaining the risk without further action because it falls within appetite or treatment is not cost-effective. Here the company has taken deliberate contractual action to assign financial loss to the processor, which is an active response rather than passive retention. Documenting acceptance would ignore the indemnification mechanism and misrepresent how the residual risk is being handled.
- ✓
Risk transfer
Why this is correct
The indemnification clause shifts the financial consequence of a breach from the e-commerce company to the payment processor, which is the defining characteristic of risk transfer. The underlying risk of a breach still exists and the company still faces reputational harm, but the monetary loss is contractually assigned to another party. Recording this as transfer correctly reflects the response strategy in the register.
- ✗
Risk avoidance
Why it's wrong here
Avoidance would mean ceasing to use the third-party payment processor or abandoning card payments altogether to eliminate the exposure. The company continues the business relationship and relies on the contract, so the risk remains present. Since the risky activity is not eliminated, avoidance is not the strategy that has been applied here, even though the vendor relationship is the source of risk.
- ✗
Risk mitigation
Why it's wrong here
Risk mitigation reduces the likelihood or impact of a risk through controls applied by the organization itself, such as encryption or access restrictions. In this scenario the company is not adding technical or procedural controls to the payment process; it is shifting financial responsibility through a contractual clause. Therefore mitigation does not accurately describe the response recorded in the risk register.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.