Which statement describes a risk transfer strategy?

• A. Accept the risk with no action.
• B. Mitigate by adding controls.
• C. Transfer the risk by purchasing insurance or outsourcing.
• D. Avoid by altering the project.

Answer: (C)

Risk transfer means moving the financial impact and responsibility for a risk to another party through contracts or insurance. By purchasing insurance, the organization shifts potential losses to the insurer; by outsourcing, a third party takes on some of the risk involved in the activity. This is the essence of transferring risk rather than eliminating it, reducing it, or simply accepting it. The other approaches—doing nothing and accepting the risk, adding controls to lessen the risk, or changing the project to avoid the risk—do not shift the risk to someone else.