A risk assessment showed that the cost of addressing a particular risk in the organization ' s human resources department is greater than the perceived benefit. Which risk response approach should the organization take in this scenario?
When a risk assessment shows that the cost of addressing a particular risk is greater than the perceived benefit, the appropriate risk response approach is to accept the risk. Risk acceptance means acknowledging that the risk exists but deciding not to take any action to mitigate it, usually because the cost of mitigation is higher than the potential impact. This approach is a rational decision when the risk is deemed to have a low likelihood or impact, or when other controls are considered sufficient.
The IIA Standards: Standard 2120 – Risk Management: " The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes. "
COSO ERM Framework: Discusses risk response options including risk acceptance as a viable strategy when the cost-benefit analysis justifies it.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit