Exam CRISC topic 1 question 494 discussion

The risk treatment adopted by the organization in this scenario is risk acceptance. By outsourcing the lease payment process to a service provider who lacks evidence of compliance with a necessary regulatory standard, the organization has effectively chosen to accept the risk associated with potential non-compliance. Risk acceptance involves acknowledging the risk and deciding to retain it without taking any immediate action to mitigate, transfer, or avoid it. In this case, the organization is aware of the risk (the service provider's lack of compliance evidence) but has proceeded with the outsourcing arrangement, implying that they have accepted the potential consequences that may arise from this decision.

when an organization outsources a process to a service provider who lacks evidence of compliance with a necessary regulatory standard, the organization is exposed to a significant risk. In this case, the organization must adopt a risk treatment strategy to mitigate the risk.

The correct answer is C. Mitigation. In risk management, "mitigation" involves taking actions to reduce the impact or likelihood of a risk. In this scenario, the organization has outsourced its lease payment process to a service provider who lacks evidence of compliance with a necessary regulatory standard. By adopting a mitigation approach, the organization might take steps to work with the service provider to ensure they meet the necessary regulatory standard, provide evidence of compliance, and thereby reduce the risk associated with the situation.

B. Transfer When an organization outsources a process (or function) to a third-party provider, it is transferring the responsibility of managing that process (and some of the associated risks) to that provider. However, it's essential to note that while some operational responsibilities might be transferred, the organization typically retains ultimate accountability for regulatory compliance.

A is correct because they outsourced its lease payment process to a service provider who lacks evidence of compliance with a necessary regulatory standard.so they acceptecd the risk.

If the contracting of the process was carried out knowing that the supplier was not compliant, then the risk was accepted.

the consequences of the risk remain with the company. risk transfer implies insurance/hold-harmless/indemnity agreement whereby the actual financial consequence of the risk is transferred to the indemnitor.

Accepting the risk is doing nothing about it.

Outsourcing is putting some control implies Mitigation. Risk transfer means transferring impact like insurance. So correct answer is C

Accepting the risk is doing nothing about it. Accepting the consequences of the outcome in case it happens. So how can it be acceptance when it was transferred to an outside vendor?.

Outsourcing is risk transfer but accountability still with organization. Outsourcing to a service provider who lacks evidence of compliance with a necessary regulatory standard is risk acceptance. so will go with A

I think the key here is that they've already outsourced, knowing the vendor they outsourced to was lacking in that area - so they "accepted" that risk.

should be transfer

Transfer or mitigation