Which term describes the decision to accept a risk according to the risk appetite?

• A. Risk acceptance
• B. Risk avoidance
• C. Risk mitigation
• D. Risk transfer

Answer: (A)

The decision to accept a risk within the risk appetite is risk acceptance. Risk appetite expresses how much risk the organization is willing to tolerate while pursuing its objectives. When a risk’s likelihood and impact are evaluated, if the residual risk after existing controls fits within what the organization is prepared to accept, leadership may choose not to take further measures and simply accept that risk as within tolerance. This is different from risk avoidance (eliminating the activity to remove the risk), risk mitigation (reducing either the likelihood or impact), or risk transfer (shifting the risk to another party, such as through insurance or outsourcing). For example, a minor, low-probability data exposure that doesn’t exceed the organization’s tolerance would be accepted rather than aggressively mitigated.