Choosing a risk response is like a doctor performing triage. A rookie might just give painkillers for a broken leg (transferring the pain), but an expert diagnoses the fracture and sets the bone (mitigating the root cause). The CRISC exam relentlessly tests your ability to be that expert, penalizing anyone who mistakes treating a symptom for curing the disease.
For the 2026 CRISC exam, the four risk treatment options are Avoid, Mitigate, Transfer, and Accept. The most appropriate choice is determined by a cost-benefit analysis that reduces risk to a level within the organization's risk appetite, prioritizes addressing the root cause, and aligns with core business objectives.
Key facts
- Official Body
- ISACA
- Exam Domains
- 4 domains covering IT risk identification, assessment, response, and monitoring.
- Passing Score
- 450 on a scale of 200-800.
- Study Hours
- 100-140 hours on average.
- Exam Format
- 150 multiple-choice questions over 4 hours.
ISACA reports the average salary for a CRISC-certified professional in North America is $145,000 (ISACA), reflecting the value of this high-judgment skill.
How Do I Choose the Right CRISC Risk Treatment Option?
Selecting the correct risk treatment is a business-driven judgment call, not a technical checklist, and it forms the core of CRISC Domain 3. The exam won't ask you to simply list the four options. It will present a complex scenario and require you to recommend the most appropriate response by weighing costs, benefits, and strategic alignment.
Studying for CRISC? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Your primary goal as a risk professional is to recommend the option that reduces risk to an acceptable level for the lowest reasonable cost. To do this, you must first understand the organization's risk appetite and risk capacity. Risk appetite is the amount of risk an organization is willing to accept in pursuit of its objectives, while risk capacity is the maximum loss it can absorb without jeopardizing its viability. The correct answer on the exam will always be the one that satisfies both constraints while supporting the business. Ready to see how this works in practice? Try VoraPrep's free CRISC practice questions that mirror these real exam scenarios.
The Four Risk Treatment Options: A Decision-Tree Playbook
The four primary risk treatment options are Avoid, Mitigate, Transfer, and Accept. Your ability to apply them correctly in a business context is what ISACA is testing. Think of it as a decision tree: your first question determines your path.
| Risk Treatment Option | Description | Key Considerations for the Exam |
|---|---|---|
| Avoid | Eliminating the risk by not starting or by stopping the activity that causes it. | The most effective option, but often impractical for existing operations. Best for new, high-risk ventures before investment. |
| Mitigate | Reducing the risk's likelihood or impact through the implementation of controls. | The most common response for existing risks. Focuses on fixing the root cause. Requires ongoing cost and monitoring. |
| Transfer | Shifting the financial consequences of a risk to a third party. | Does not reduce the risk itself. Insurance and outsourcing are classic examples. You still own the reputational and operational risk. |
| Accept | Formally deciding to take no action and bear the full potential loss from the risk. | Only for risks within appetite or where the treatment cost exceeds the benefit. Requires documented management approval. |
A proper decision is informed by a Cost-Benefit Analysis (CBA). The CBA is a quantitative exercise comparing the cost of a control to the reduction in Annualized Loss Expectancy (ALE). However, the final recommendation must integrate this analysis with critical qualitative factors. These include reputational impact, regulatory penalties, and alignment with strategic goals. A cheap technical fix that damages the company's brand is never the right answer on the CRISC exam.
Worked Example: Choosing a Risk Treatment Under Exam Pressure
Let's walk through a realistic CRISC scenario. Pay close attention to how the numbers and the company's stated policies drive the decision.
Scenario: "Phoenix Corp., a mid-sized e-commerce company, identifies a critical vulnerability in its aging customer relationship management (CRM) system. The Annualized Loss Expectancy (ALE) from a potential data breach is estimated at $400,000. Phoenix Corp.'s risk appetite statement indicates a willingness to accept residual risk up to $50,000 for any single IT asset." Proposed Treatment Options:- Option A (Avoidance): Decommission the CRM and halt e-commerce operations until a new system is implemented. Cost: $1,200,000 (new system plus lost revenue).
- Option B (Mitigation): Implement comprehensive patching, deploy an advanced Intrusion Detection and Prevention System (IDPS), and encrypt sensitive data at rest. Cost: $150,000 upfront + $25,000 annually. This is projected to reduce the breach likelihood by 80% and the impact by 50%.
- Option C (Transfer): Purchase a cyber insurance policy with a $500,000 coverage limit and a $50,000 deductible. Annual premium: $75,000. The policy explicitly excludes coverage for reputational damage or regulatory fines.
- Option D (Acceptance): Take no action and continue monitoring the system.
Step 1: Analyze the Baseline Risk
First, establish the facts from the scenario.- Inherent ALE: $400,000
- Risk Appetite (Maximum acceptable residual risk): $50,000
The goal is to find the most cost-effective option that brings the residual risk below the $50,000 threshold.
Step 2: Evaluate Each Treatment Option
Now, let's analyze each choice quantitatively and qualitatively.
- Option A (Avoidance):
- Cost: $1,200,000.
- Residual ALE: $0.
- Analysis: This eliminates the risk completely but at a cost that is three times the potential annual loss. The operational disruption of halting e-commerce is massive. This is not a viable business decision.
- Option B (Mitigation):
- Cost (Year 1): $150,000 + $25,000 = $175,000.
- Residual ALE Calculation: The controls reduce the likelihood of occurrence by 80% (affecting the ARO) and the financial impact by 50% (affecting the SLE). The combined effect reduces the overall ALE.
- Residual ALE = Original ALE × (1 − Likelihood Reduction %) × (1 − Impact Reduction %)
- Residual ALE = $400,000 × (1.0 − 0.80) × (1.0 − 0.50)
- Residual ALE = $400,000 × 0.20 × 0.50 = $40,000.
- Analysis: The residual ALE of $40,000 is below the $50,000 risk appetite. The cost is significant but less than the original ALE, representing a positive return on investment. Crucially, this option addresses the root cause of the vulnerability.
- Option C (Transfer):
- Cost: $75,000 annual premium.
- Residual Risk: The inherent risk of a breach (ALE of $400,000) still exists. The treatment only transfers the direct financial loss. The system is just as vulnerable as before.
- Residual Financial Exposure: If a breach occurs, the company pays the $75,000 premium plus the $50,000 deductible. It also bears the full, uninsurable cost of reputational damage, customer churn, and potential regulatory fines.
- Analysis: This option does not reduce the likelihood or impact of the event. It's a financial instrument, not a security control.
- Option D (Acceptance):
- Cost: $0.
- Residual ALE: $400,000.
- Analysis: This leaves the risk at eight times the stated $50,000 appetite. This is an automatic disqualification and represents negligence.
Step 3: Compare Options and Make a Recommendation
Option B is the only choice that directly reduces the risk to an acceptable level ($40,000 < $50,000) while addressing the root cause. Although Option C has a lower upfront cost ($75k premium vs $175k mitigation cost), it leaves the company exposed to the breach itself and significant uncovered losses.
The most appropriate recommendation is Option B (Mitigation). It aligns with the risk appetite, provides a positive return on security investment, and demonstrates due care by fixing the actual problem. This is the kind of multi-faceted thinking ISACA rewards. For a deeper dive into the math, see our guide on calculating SLE, ARO, and ALE for the CRISC exam.
Use this mental checklist for any CRISC scenario question:
- Identify Inherent Risk: What is the current ALE or risk level?
- Define Acceptable Risk: What is the stated risk appetite?
- Analyze Each Option: For each treatment, calculate the cost and the resulting residual risk.
- Incorporate Qualitative Factors: Consider reputation, compliance, and strategic alignment. Does the treatment address the root cause?
- Recommend: Select the option that brings residual risk below appetite, provides the best cost-benefit (including qualitative factors), and aligns with business objectives.
Calculate Your CRISC Score & Study Hours by Domain
Adjust your practice scores across official CRISC blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
Common Mistakes and a Better Memory Hook
The most common errors on these questions stem from predictable mental shortcuts.
- Ignoring Risk Appetite: An answer might seem technically correct, but if the resulting residual risk is still above the appetite given in the scenario, it is the wrong answer. Always check the threshold.
- Choosing Transfer as a Fix: Insurance is not a security control. The exam will punish you for choosing to transfer a risk that could have been cost-effectively mitigated. While transfer is a valid primary response, it is a financial tool for shifting loss, not a method for fixing an underlying vulnerability.
- Miscalculating Benefit: The expected benefit of a control is the reduction in ALE. A control that costs $50,000 and reduces ALE by $200,000 provides a net benefit of $150,000. A control that costs $50,000 and reduces ALE by only $30,000 is a bad investment.
Forget confusing acronyms. Use ARTA to structure your thinking like a seasoned risk professional.
- Avoid: Can we stop doing this? (The first choice for new, high-risk activities).
- Reduce (Mitigate): Can we fix the root cause and make it safer? (The most common choice for existing operations).
- Transfer: Can someone else pay for it if it goes wrong? (A financial tool, not a security fix).
- Accept: Can we live with the remaining risk? (Only for low-level risks within appetite).
This simple progression helps you prioritize the most effective options first. To see how these options connect to broader strategy, explore our guide to CRISC Domain 3: Risk Response and Reporting.
How to Solidify This for the Exam
Reading about triage isn't the same as performing it under pressure. You need to build muscle memory by applying these concepts repeatedly.
- Drill the Definitions: Use VoraPrep's FSRS flashcards to burn the specific definitions of Avoid, Mitigate, Transfer, and Accept into your memory. You must know the precise difference without hesitation.
- Work Scenario Questions: Dedicate study sessions to answering only Domain 3 questions. VoraPrep's adaptive question bank has over 1,800 questions and will automatically focus on your weak areas until you master them.
- Explain Your Answers: For every practice question, force yourself to write one sentence explaining why the right answer is right and why each of the three distractors is wrong. If you can't, you don't truly understand it yet.
- Ask Vory: When you get stuck on a tough cost-benefit analysis, don't just look at the answer. Ask Vory, your 24/7 personal tutor, to walk you through the calculation step-by-step. Understanding the process is more important than memorizing one answer.
A complete preparation system combines lessons, adaptive practice, and expert support. You can find all of this in the VoraPrep CRISC course.
Ready to Pass Your CRISC Exam?
Don't leave your CRISC success to chance. VoraPrep offers a complete 6-pillar interactive course with 1,800+ practice questions, detailed explanations, and an adaptive learning engine that targets your weak areas. Our $25/month or $199/year subscription, backed by a 14-day free trial, is designed for busy professionals like you. Vory, your 24/7 personal tutor, is always there to guide you.
Visit voraprep.com to get started and experience a modern, effective way to prepare for your CRISC certification.
Start Your Free 14-Day Trial at voraprep.com →