Risk Response Options for CISM: Accept, Avoid, Mitigate, Transfer

2026-10-19

Risk treatment is central to CISM Domain 2. Questions rarely ask for definitions; they ask who decides and which response fits.

The four responses

• Mitigate (reduce): apply controls that lower likelihood or impact. Example: multifactor authentication against account takeover.
• Transfer or share: move part of the financial impact to another party. Example: cyber insurance or contractual indemnity.
• Avoid: stop the activity that creates the risk. Example: not launching a product that would require storing card data.
• Accept: retain the risk knowingly, documented and approved by someone with authority.

Who decides

The risk owner — the business manager accountable for the affected process — decides on treatment and accepts residual risk, within delegated authority. The information security manager assesses, advises and reports. Options where security accepts risk on the business's behalf are traps.

How to choose

1. Compare residual risk with risk appetite.
2. If within appetite, acceptance may be appropriate.
3. If above appetite, mitigate where a cost-effective control exists.
4. If controls cost more than the risk, consider transfer or acceptance at the right level.
5. If the risk is far beyond appetite and cannot be reduced, consider avoidance.

What transfer does not transfer

Insurance and contracts move money, not accountability. Reputational damage, customer trust and regulatory responsibility usually stay with the organization. Exclusions and deductibles also leave retained risk that belongs on the register.

Good acceptance looks like this

• Documented, with the risk clearly described.
• Approved by someone with authority proportionate to the risk.
• Time-limited and re-evaluated when conditions change.
• Supported by compensating controls where possible.

Typical CISM scenarios

• A control costs more than the loss it prevents → present the analysis; the owner may accept.
• A product creates risk far above appetite → escalate; avoidance may be right.
• A manager accepted a risk beyond their authority → escalate to the right level.
• An acceptance has expired → reassess and decide again.

A quick formula

When questions involve numbers: ALE = SLE × ARO, and SLE = asset value × exposure factor. A control is worth it when the reduction in ALE exceeds its annual cost.

Related on Auditor Path

• Risk appetite
• Risk transfer
• Risk avoidance
• Annualized loss expectancy (ALE)
• The business owns its risk

Sources

ISACA CISM exam content outline, Domain 2 Part B — Risk Treatment/Risk Response Options.