Question

A risk practitioner is reviewing a proposed control to mitigate a data-integrity risk. The annual cost of implementing and operating the control is estimated at $250,000, while the control is expected to reduce annualized loss expectancy from $180,000 to $40,000. Management is eager to proceed because the risk relates to a high-visibility system. What should the risk practitioner recommend?

Accepted Answer

Reject the proposed control and evaluate lower-cost response options, since the control cost exceeds the reduction in expected loss

Answer

Proceed with the control because it addresses a high-visibility system

Answer

Transfer the risk entirely to a third party regardless of cost

Answer

Accept the risk at its current level without further analysis