CRISC Certified in Risk and Information Systems ControlRisk Response and ReportingEasy
A global manufacturing company is implementing a new enterprise resource planning (ERP) system. During the risk assessment, a critical risk is identified: 'Failure of data migration from legacy systems leading to significant operational disruption.' The project manager proposes assigning a dedicated data migration team, conducting multiple pilot migrations, and implementing a rollback plan. Which of the following best describes the primary goal of these actions?
- ATransfer the risk to a third party.
- BAccept the residual risk.
- CReduce the likelihood of the risk.
- DIncrease the impact of the risk.
Show answer & explanationAnswer & explanation
Correct answer: C. Reduce the likelihood of the risk.
Dedicated teams, pilot migrations, and rollback plans are all measures designed to prevent the data migration failure from occurring, thereby reducing the probability or frequency of the risk event.
Why the other options are wrong
- A. These actions keep the responsibility for the risk within the company, rather than shifting it.
- B. These are proactive steps, not an acceptance of the risk.
- D. These actions aim to decrease, not increase, the negative impact of the risk.
Risk Likelihood Reduction
A risk response strategy focused on implementing controls and measures to decrease the probability or frequency of a specific risk event occurring.
- Aims to prevent the risk from materializing.
- Involves proactive controls and process improvements.
- Examples include training, redundancy, and robust testing.
Memory trick: Likelihood is Lowered by Proactive Prevention.