The statement that a lack of controls is acceptable if the risk is reduced to an acceptable level in some other way is true. Risk management involves identifying, assessing, and responding to risks to achieve the objectives of the organization. If a risk can be mitigated to an acceptable level through alternative means other than traditional controls, such as risk avoidance or risk transfer, this approach can be deemed acceptable.
Risk management standards and frameworks, such as COSO and ISO 31000.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit