Risk avoidance
- Term
- Risk avoidance
- Exam
- CISA & CISM
- Definition
Eliminating a risk by not doing the activity that creates it.
- Explained
Avoidance eliminates a risk by not doing the activity that creates it — for example, declining to store card data. It suits risks far beyond appetite that cannot be reduced cost-effectively, and it is a business decision.
- In practice
Deciding not to launch a product that would require storing card data.
- Often confused with
- Risk transfer
- Exam angle
Appropriate when risk is far beyond appetite and cannot be reduced.
- Related