CRISC Exam - Question 258

Question

An organization has outsourced its lease payment process to a service provider who lacks evidence of compliance with a necessary regulatory standard. Which risk treatment was adopted by the organization?

Examice · Accepted Answer

The organization has outsourced its lease payment process to a service provider who lacks evidence of compliance with a necessary regulatory standard, implying they are aware of the risk involved. By proceeding with this service provider despite the compliance risk, the organization has chosen to retain the risk without taking any steps to mitigate, transfer, or avoid it. This decision aligns with the concept of risk acceptance, which involves acknowledging a risk and deciding to accept the potential consequences without further action.

Raj1510 · Answer

Outsourcing is risk transfer but accountability still with organization. Outsourcing to a service provider who lacks evidence of compliance with a necessary regulatory standard is risk acceptance. so will go with A

john_boogieman · Answer

If the contracting of the process was carried out knowing that the supplier was not compliant, then the risk was accepted.

mclaiborne · Answer

I think the key here is that they've already outsourced, knowing the vendor they outsourced to was lacking in that area - so they "accepted" that risk.

AMIRA1986 · Answer

Transfer or mitigation

Josh93 · Answer

should be transfer

Ceecil1959 · Answer

Accepting the risk is doing nothing about it. Accepting the consequences of the outcome in case it happens. So how can it be acceptance when it was transferred to an outside vendor?.

Annyp · Answer

Outsourcing is putting some control implies Mitigation. Risk transfer means transferring impact like insurance. So correct answer is C

Boubou480 · Answer

Accepting the risk is doing nothing about it.

cybervds · Answer

the consequences of the risk remain with the company. risk transfer implies insurance/hold-harmless/indemnity agreement whereby the actual financial consequence of the risk is transferred to the indemnitor.

Anonymous · Answer

A is correct because they outsourced its lease payment process to a service provider who lacks evidence of compliance with a necessary regulatory standard.so they acceptecd the risk.

01010100 · Answer

B. Transfer

When an organization outsources a process (or function) to a third-party provider, it is transferring the responsibility of managing that process (and some of the associated risks) to that provider. However, it's essential to note that while some operational responsibilities might be transferred, the organization typically retains ultimate accountability for regulatory compliance.

Staanlee · Answer

The correct answer is C. Mitigation.

In risk management, "mitigation" involves taking actions to reduce the impact or likelihood of a risk. In this scenario, the organization has outsourced its lease payment process to a service provider who lacks evidence of compliance with a necessary regulatory standard. By adopting a mitigation approach, the organization might take steps to work with the service provider to ensure they meet the necessary regulatory standard, provide evidence of compliance, and thereby reduce the risk associated with the situation.

eblue · Answer

when an organization outsources a process to a service provider who lacks evidence of compliance with a necessary regulatory standard, the organization is exposed to a significant risk. In this case, the organization must adopt a risk treatment strategy to mitigate the risk.

Joloms · Answer

The risk treatment adopted by the organization in this scenario is risk acceptance.

By outsourcing the lease payment process to a service provider who lacks evidence of compliance with a necessary regulatory standard, the organization has effectively chosen to accept the risk associated with potential non-compliance. Risk acceptance involves acknowledging the risk and deciding to retain it without taking any immediate action to mitigate, transfer, or avoid it.

In this case, the organization is aware of the risk (the service provider's lack of compliance evidence) but has proceeded with the outsourcing arrangement, implying that they have accepted the potential consequences that may arise from this decision.

CRISC Exam - Question 258

Discussion