Risk transfer
- Term
- Risk transfer
- Exam
- CISA & CISM
- Definition
Shifting the financial impact of a risk to another party, such as through insurance.
- Explained
Transfer moves part of the financial impact of a risk to another party, typically through insurance or contracts. It does not transfer accountability, reputational damage or regulatory responsibility, and deductibles and exclusions leave retained risk.
- In practice
Buying cyber insurance to cover breach response costs.
- Often confused with
- Risk avoidance
- Exam angle
Accountability and reputational damage generally stay with the organization.
- Related