Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
The risk treatment adopted by the organization in this scenario is risk acceptance. By outsourcing the lease payment process to a service provider who lacks evidence of compliance with a necessary regulatory standard, the organization has effectively chosen to accept the risk associated with potential non-compliance. Risk acceptance involves acknowledging the risk and deciding to retain it without taking any immediate action to mitigate, transfer, or avoid it. In this case, the organization is aware of the risk (the service provider's lack of compliance evidence) but has proceeded with the outsourcing arrangement, implying that they have accepted the potential consequences that may arise from this decision.
when an organization outsources a process to a service provider who lacks evidence of compliance with a necessary regulatory standard, the organization is exposed to a significant risk. In this case, the organization must adopt a risk treatment strategy to mitigate the risk.
The correct answer is C. Mitigation. In risk management, "mitigation" involves taking actions to reduce the impact or likelihood of a risk. In this scenario, the organization has outsourced its lease payment process to a service provider who lacks evidence of compliance with a necessary regulatory standard. By adopting a mitigation approach, the organization might take steps to work with the service provider to ensure they meet the necessary regulatory standard, provide evidence of compliance, and thereby reduce the risk associated with the situation.