Information Security Risk Management · Topic 2 of 2
Risk Response, Ownership and Monitoring
Mitigating, transferring, avoiding and accepting risk, residual risk, risk and control ownership, key risk indicators and reporting risk to management.
- 3 min
- Includes a diagram
- Four responses: mitigate, transfer, avoid, accept.
- Transferring risk does not transfer accountability.
- Residual risk must be within appetite or formally accepted at the right level.
What it is
Risk response is the decision on what to do about each assessed risk. Ownership makes sure a named person is accountable for each risk and each control. Monitoring and reporting keep management aware of how risk is changing, so decisions can be adjusted before problems become incidents.
How it works
Response options
| Option | What it means | Example |
|---|---|---|
| Mitigate | Reduce likelihood or impact with controls | Add MFA, encrypt data |
| Transfer (share) | Shift financial impact to another party | Cyber insurance, contract terms with a provider |
| Avoid | Stop the activity that creates the risk | Decline a project, retire a system |
| Accept | Consciously keep the risk | Formal acceptance by an owner with authority, within appetite |
The choice depends on the risk appetite, the cost of the response compared with the reduction in risk, legal requirements and business priorities. Transferring risk shifts some financial consequences, but accountability stays with the organization.
Residual risk and acceptance
Residual risk is what remains after treatment. It should be within the risk appetite. If it is not, further treatment is needed, or management with authority for that level of risk formally accepts it. Acceptance should be documented, time-limited and reviewed, not left open.
When a business unit wants to proceed with a risk above the appetite, the security manager makes sure the decision is escalated to the level that has authority to accept it, with the risk clearly explained.
Risk and control ownership
| Role | Accountable for |
|---|---|
| Risk owner | A business manager accountable for the risk and for deciding how it is treated |
| Control owner | The person accountable for a control being designed and operated properly |
| Information security manager | Facilitating the process, advising on options, and reporting |
Ownership must sit with someone who has the authority and budget to act. Unowned risks and controls drift.
Monitoring
| Tool | Purpose |
|---|---|
| Key risk indicators (KRIs) | Early warning that a risk is rising, such as unpatched critical systems or privileged accounts not reviewed |
| Control monitoring and testing | Confirms controls still operate |
| Risk register reviews | Keep ratings, owners and treatments current |
| Triggers for reassessment | New threats, incidents, business or technology changes |
Reporting
Reports to senior management and the board should be in business terms, focus on the most significant risks and their trends against appetite, show where treatment is late and highlight decisions needed. Accurate reporting matters most when the news is bad: a risk rating should follow the agreed method, even under pressure to soften it.
How the exam asks about this
- "Which response buys insurance?" Transfer.
- "Who should accept a residual risk above the appetite?" Senior management with the authority to accept it, after escalation.
- "Which BEST shows the board whether risk is falling?" The trend of top residual risks against appetite.
What to remember for the exam
- Four responses: mitigate, transfer, avoid, accept.
- Transferring risk does not transfer accountability.
- Residual risk must be within appetite or formally accepted at the right level.
- Risk owners are business managers; the security manager facilitates.
- KRIs give early warning; reports show trends against appetite in business terms.
An acceptance signed by someone without authority for that level of risk is not a valid risk decision, and one with no review date is easily left in place after conditions change.
Common mistakes
Making the security manager the risk owner.
Treating risk acceptance as permanent.
Reporting activity counts instead of risk trends.
Check yourself
What is residual risk?
The risk that remains after a risk response has been applied.
What does a key risk indicator provide?
Early warning that a risk is increasing.
Does transferring a risk to an insurer transfer accountability?
No. Some financial impact moves, but the organization remains accountable.
Topic 2 of 2 in Information Security Risk Management
Test yourself on Information Security Risk Management
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.