Which among the following is the BEST reason for defining a risk response?

A.
To eliminate risk from the enterprise

B.
To ensure that the residual risk is within the limits of the risk appetite and tolerance

C.
To overview current status of risk

D.
To mitigate risk

Explanation:

The purpose of defining a risk response is to ensure that the residual risk is within the limits of the
risk appetite and tolerance of the enterprise. Risk response is based on selecting the correct,
prioritized response to risk, based on the level of risk, the enterprise’s risk tolerance and the cost
or benefit of the particular risk response option.
Answer A is incorrect. Risk cannot be completely eliminated from the enterprise.
Answer D is incorrect. Mitigation of risk is itself the risk response process, not the reason behind
this.
Answer C is incorrect. This is not a valid answer.