Which concept includes using a set of responses so that residual risk approaches risk appetite?

Which concept includes using a set of responses so that residual risk approaches risk appetite?

• A. Risk transfer
• B. Risk sharing
• C. Safeguard
• D. Risk response

Answer: (D)

The idea being tested is risk response—the planned set of actions you apply to identified risk to bring the remaining (residual) risk down to the level the organization is willing to accept, i.e., its risk appetite. After safeguards are put in place, some residual risk can still exist, and the goal is to choose and implement a combination of responses (such as reducing likelihood or impact, avoiding the risk, transferring or sharing it, or accepting it when it falls within appetite) so the final residual risk aligns with what the organization is willing to tolerate. A safeguard is a specific control, while risk transfer or risk sharing describe ways to shift risk elsewhere, and they don’t by themselves denote the broader planning and combination of actions intended to achieve an appetite-aligned residual risk.