Which risk response is considered the core focus of risk management?

Which risk response is considered the core focus of risk management?

• A. Avoidance
• B. Acceptance
• C. Transference
• D. Mitigation

Answer: (D)

The main aim of risk management is to reduce risk exposure by mitigating risks. Mitigation involves putting in place controls and safeguards that lower both the likelihood of a risk event occurring and the impact if it does occur. In IT, this includes actions like patch management, strong access controls, encryption, redundancy, backups, disaster recovery planning, and security monitoring. These steps actively reduce the chances and consequences of threats, which is why mitigation is the best fit as the focus of risk management.

Avoidance eliminates risk by changing the plan or exiting the activity, transference shifts risk to another party, and acceptance involves acknowledging the risk without taking action. While these are legitimate strategies in some scenarios, they do not continuously reduce risk exposure the way mitigation does, making mitigation the most central practice in managing risk.