Risk management programs are designed to reduce risk to:

A.
a level that is too small to be measurable.

B.
the point at which the benefit exceeds the expense.

C.
a level that the organization is willing to accept.

D.
a rate of return that equals the current cost of capital.

Explanation:

Risk should be reduced to a level that an organization is willing to accept. Reducing risk to a level
too small to measure is impractical and is often cost-prohibitive. To tie risk to a specific rate of
return ignores the qualitative aspects of risk that must also be considered. Depending on the risk
preference of an organization, it may or may not choose to pursue risk mitigation to the point at
which the benefit equals or exceeds the expense. Therefore, choice C is a more precise answer.