CRISC Risk Response and Mitigation Practice Question
For a risk with very low likelihood and low impact, what is the typical risk response?
⚠ Common exam trap
The trap here is that candidates mistakenly apply mitigation or transfer to all risks, failing to recognize that acceptance is the default response for low-likelihood, low-impact risks where the cost of treatment exceeds the potential loss.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Accept
When a risk has very low likelihood and low impact, the cost of implementing controls (mitigation, transfer, or avoidance) typically exceeds the potential loss. Accepting the risk is the most cost-effective response, as it acknowledges the residual risk without active treatment. This aligns with the principle that risk acceptance is appropriate for risks below the organization's risk appetite threshold.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mitigate
Why it's wrong here
Mitigation is unnecessary.
- ✗
Transfer
Why it's wrong here
Transfer shifts financial consequence to a third party, typically via insurance or outsourcing, which costs more than the exposure justifies when both likelihood and impact are low. It is tempting because transfer is a recognised response, and would be correct for a low-likelihood risk whose impact is high enough to warrant paying a premium.
- ✗
Avoid
Why it's wrong here
Avoidance eliminates the activity generating the risk, forfeiting its business benefit for an exposure that is already low on both likelihood and impact. It is tempting because avoidance removes risk entirely, and would be correct where impact is severe and unavoidable through other means, such as regulatory prohibition of the activity.
- ✓
Accept
Why this is correct
Acceptance suits risks whose likelihood and impact both sit at the lowest band, where treatment cost exceeds expected loss. The organisation retains the risk knowingly, monitors it, and allocates no further controls, which is proportionate given the negligible exposure.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.