A residual risk sits just above the organisation's stated risk appetite, and the cost of further controls would clearly exceed the potential loss. The business owner is willing to live with the exposure. Which risk treatment should the practitioner recommend?
- AAccept the residual risk with documented, informed sign-off from the business owner. Correct
- BTransfer the exposure to an insurer so the financial impact falls on a third party.
- CAvoid the risk by retiring the underlying activity that generates the exposure.
- DMitigate further by adding controls until the residual sits below appetite.
Why A is correct: When treatment cost exceeds the potential loss and the owner accepts the exposure, formal informed acceptance is the economically rational and accountable choice.
Why B is wrong: Transfer through insurance shifts financial impact but adds premium cost, which is hard to justify when the residual loss is already smaller than further treatment spend.
Why C is wrong: Avoidance removes the activity entirely, an extreme response that sacrifices business value when the exposure is only marginally above appetite.
Why D is wrong: Adding controls feels safe, but spending more than the loss is worth destroys value and is not warranted for a marginal breach of appetite.