問題文
A scenario has been assessed as above the enterprise's risk tolerance, and no cost-effective control is available. Which treatment options remain open to the enterprise?
選択肢
- Accept the risk since the absence of a cost-effective control means that no other response is available to the enterprise and the activity has already been approved as part of the business plan for the year.
- Avoid the activity and transfer part of the exposure or accept it with documented approval at the right level.
- Reduce the assessed impact by revising the impact criteria so that the scenario falls back inside the tolerance that the enterprise has already set for this category of risk.
- Escalate the scenario to internal audit and ask that function to determine which treatment the enterprise should adopt in the circumstances.