CRISC Certified in Risk and Information Systems ControlIT Risk AssessmentMedium
A global e-commerce company is evaluating the risk of a major data breach involving customer credit card information. The risk analysis team has identified the potential impact as 'Critical' and the likelihood as 'High' based on a qualitative risk matrix. Given the organization's risk appetite, which states that 'risks with Critical impact and High likelihood are unacceptable and require immediate action', what is the MOST appropriate next step for the risk manager?
- ADevelop and implement a comprehensive risk mitigation plan.
- BAccept the risk, as some level of data breach risk is inherent in e-commerce.
- CTransfer the risk by purchasing additional cyber insurance coverage.
- DDocument the risk in the risk register and monitor it periodically.
Show answer & explanationAnswer & explanation
Correct answer: A. Develop and implement a comprehensive risk mitigation plan.
According to the organization's risk appetite, a 'Critical impact' and 'High likelihood' risk is unacceptable and requires immediate action. This directly points to developing and implementing a comprehensive mitigation plan to reduce either the likelihood or impact (or both) of the risk.
Why the other options are wrong
- B. Accepting the risk contradicts the defined risk appetite, which deems this level of risk unacceptable.
- C. While insurance transfers financial impact, it doesn't reduce the likelihood or initial operational impact, and the prompt specifically asks for action on an 'unacceptable' risk, implying a reduction in its inherent nature.
- D. Monitoring is insufficient when the risk is explicitly stated as 'unacceptable' and requiring 'immediate action'.
Risk Appetite
The amount and type of risk that an organization is willing to pursue or retain in pursuit of its business objectives.
- Sets boundaries for acceptable risk levels.
- Influences risk response decisions.
- Expressed qualitatively or quantitatively.
Memory trick: Risk Response: Avoid, Transfer, Mitigate, Accept – ATM's for your risk money.