CRISC IT Risk Assessment Practice Question
An organization decides to discontinue a high-risk business process that cannot be effectively mitigated. This is an example of which risk treatment option?
⚠ Common exam trap
Test-takers frequently confuse avoidance with acceptance — both can result in 'doing nothing to the risk,' but avoidance removes the source of risk while acceptance retains it, and the exam uses 'discontinue' or 'cease' as the giveaway keyword for avoidance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk avoidance
Risk avoidance is the deliberate decision to eliminate the activity, process, or asset that gives rise to the risk rather than trying to control it. Discontinuing a high-risk business process removes the risk entirely because the underlying activity no longer exists. This is the only treatment option that makes the risk disappear rather than reducing, sharing, or tolerating it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk acceptance
Why it's wrong here
Discontinuing the process eliminates the activity generating the risk, which is risk avoidance, not acceptance; acceptance retains the process and acknowledges the residual risk without further treatment. It is tempting because both involve deciding not to mitigate, and acceptance would be correct where the organisation keeps the process and tolerates the exposure.
- ✗
Risk transfer
Why it's wrong here
Transferring risk shifts financial consequence to a third party, such as an insurer, while the process continues operating. Discontinuing the process removes the risk entirely, which is avoidance. Transfer suits scenarios where a process must continue but its impact can be indemnified.
- ✗
Risk mitigation
Why it's wrong here
Mitigation applies controls to reduce likelihood or impact while the process continues. Discontinuing the process eliminates the risk rather than reducing it, so this describes avoidance. Mitigation would be correct if the organisation retained the process and added compensating controls.
- ✓
Risk avoidance
Why this is correct
Discontinuing the high-risk process eliminates the risk source entirely rather than reducing, transferring or accepting it. Avoidance is the only treatment that removes the activity generating the risk, satisfying the stem's constraint that mitigation cannot effectively reduce it.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.