Question

A financial services firm has identified a risk scenario involving a catastrophic data center flood: the estimated likelihood is very low, but a single occurrence would exceed the organization's risk capacity and threaten solvency. Mitigation controls have been implemented to their practical limit, yet the residual exposure remains beyond appetite. Which risk response should the risk practitioner recommend the organization consider next?

Accepted Answer

Transfer the residual exposure through insurance while retaining the existing mitigation controls

Answer

Formally accept the residual risk because the likelihood is very low

Answer

Add additional detective controls to further reduce the likelihood of the flood

Answer

Avoid the risk by discontinuing all operations dependent on the data center