A proposed control would cost $250,000 a year to reduce a risk whose expected annual loss is $40,000. The current level of risk is within the organization's risk appetite. What is the MOST appropriate risk response?
Select an answer to reveal the explanation.
Short Explanation
You wouldn't buy a $250 lock to protect a $40 bike, especially when you're already comfortable with the risk. When a control costs more than the loss it prevents and you're within appetite, formal acceptance is the smart move. The trap is thinking every risk must be reduced no matter the price.
Full Explanation
Risk response decisions balance the cost of treatment against the benefit it delivers within the bounds of risk appetite. A control costing $250,000 a year to address an expected annual loss of $40,000 spends far more than it could save, and the current risk already sits within appetite. The appropriate response is acceptance, formally documented and approved by the risk owner, with ongoing monitoring so that a change in likelihood or impact triggers reconsideration. Implementing the control regardless of cost contradicts risk-based management, which aims for acceptable risk rather than the lowest possible risk at any price. Avoidance by discontinuing the activity would sacrifice business value to eliminate a risk that the organization is already willing to bear. Deferring the decision leaves the risk in limbo without an owner's decision; if a cheaper option emerges later it can be considered, but acceptance within appetite is a valid decision now. Exam caveat: non-financial impacts such as safety or regulatory consequences could change the conclusion, so they should be confirmed before acceptance. Operational check: confirm the acceptance is recorded with the owner's signature, the rationale, a review date and a key risk indicator that would trigger reassessment.