Which statement correctly describes IRM risk treatment architecture?
Select an answer to reveal the explanation.
Short Explanation
Four doors: accept, avoid, mitigate, transfer. Acceptance is still a deliberate, owned decision—not sweeping it under the rug. Transferring risk also does not mean the register magically forgets it existed.
Full Explanation
IRM risk treatment architecture includes accept, avoid, mitigate, and transfer—and acceptance is a governed decision, not neglect. Civic programs need all four doors with ownership and review. Claiming mitigate is the only valid treatment and the others are informal notes fails by concept because accept, avoid, and transfer are first-class treatments. Claiming acceptance means ignoring the risk with no owner or review fails by concept because governed acceptance requires accountability and revisit. Claiming transfer always deletes the risk from the entity register fails by concept because transfer records the treatment while typically retaining visibility of residual and ownership. Exam caveat: CIS-RC recognizes four treatments, with acceptance as deliberate governance. Operational check: on sample risks, exercise each treatment type with required fields (owner, rationale, review date for accept; decommission evidence for avoid; tasks for mitigate; contract/insurance reference for transfer) and confirm none silently deletes accountability. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.