Exam CISM topic 1 question 560 discussion

risk cannot be eliminated they can only be reduced.

A- because risk can never be eliminated!

A includes B (when feasible)

Word "elimination" really bothers me, but it is the best answer, since since some risks can indeed be eliminated though risk treatment option such as risk avoidance. If you stop doing the thing that brings risk, you effectively eliminated the risk, for all intents and purposes.

A. Implementation of corrective actions is the correct answer. B. Elimination of risk is an ideal that cannot be achieved. It's like striving for the ideal of perfection. According to CISM Review Manual: Preparing for ISACA Certified Information Security Manager Exam by Gwen Bettwy, Mark Williams, Mike Beevers, Eliminating risk is not always practical or feasible.

I dont like the word elimination but it is still the best answer

I go with A- Implementation of corrective actions. The manner in which B is worded is not the correct answer because risk can never be eliminated until there is no risk left. Risk can only be mitigated.

A. Implementation of corrective actions

The goal of risk treatment is to reduce the level of risk to an acceptable level that aligns with the organization's risk appetite and objectives. The closest one to this is (B) Elimination of Risk. Rationale: A. Implementation of corrective actions is incorrect cause this takes place after the risk has been realized, but the goal of risk treatment is preventative (i.e. before the risk is realized) C. Timely reporting of incidents is great, but it does nothing to address risks. D. Reduced cost of acquiring controls is great, but it does not reduce the risk.

The most important outcome of effective risk treatment is the elimination or reduction of risk to an acceptable level. This is accomplished by implementing appropriate controls and measures to mitigate the potential impact of identified risks. Other outcomes, such as implementation of corrective actions, timely reporting of incidents and reduced cost of acquiring controls, are important aspects of risk management, but they are ultimately secondary to achieving the primary goal of reducing or eliminating risk.