Exam CRISC topic 1 question 915 discussion

When an organization postpones the assessment and treatment of risk scenarios due to stakeholder unavailability or other reasons, the risk is considered "deferred." This means the organization has chosen to delay action on the risk until a later time, rather than accepting, mitigating, or transferring it.

The best answer is C. deferred. Here's why: Postponed assessment and treatment: The organization has chosen to delay the assessment and treatment of the risks. This means that the risks have not been addressed in any way, and their potential impact remains unmitigated. Risk remains unaddressed: By delaying the assessment and treatment, the organization has essentially chosen to not address the risks at this time. This does not mean that the risks have been eliminated or resolved; they simply remain unaddressed and unmitigated. Deferred action: Deferring action implies that the organization intends to address the risks at a later date. This is different from accepting or transferring the risks, which would involve permanently relinquishing responsibility for them.

According to ISACA, when an organization decides to postpone the assessment and treatment of several risk scenarios because stakeholders are unavailable, the risk associated with these new entries is deferred. : Communicating Information Security Risk Simply and Effectively, Part 2: A Three-Step Process for Top Management

It is A. There's no such thing as defer in ISACA materials for risk treatment options.

Some reasoning is a bit scary and can be solved simply with a little study of the basics. Obviously there is no risk treatment action that is 'deferring it' and 'avoiding it' means that the treatment associated with the risk is no longer carried out. Doing nothing means that the organization is accepting the risk.

Risk Avoidance. They did not move on with the activity. Meaning they avoided the action. In other words deferred.

A is correct. No such thing as deferred risk. Change can be deferred.

A is correct

TBH this is the first time I heard 'deffer' as risk response strategy. If they postponed the risk response due to certain reasons they accepted the risk as it will be untreated until stakeholders are not available.