Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Annualized cost of the control is greater than the ALE. Implementing the control would cost more than the expected loss from the risk. Acceptance is the best option.
C. Accept Accepting the risk is often the most appropriate response when the cost of implementing controls to mitigate the risk is greater than the potential loss from the risk itself. In this case, it would not be cost-effective to spend more on controls than the expected loss due to the risk. Risk acceptance means that the organization acknowledges the risk and decides to bear any potential losses or impacts without taking further action to control or mitigate the risk.
Can you avoid "a critical, proprietary business function"? I don't think so. If you transfer the risk, the annualized control cost will still be higher than the annual loss expectancy. Therefore, accepting.