When the cost of treating a risk exceeds the potential impact of the risk event itself, the organization should:
-
A
Accept the risk and document the rationale with management approval
-
B
Always implement the treatment regardless of cost as a matter of due diligence
-
C
Escalate the risk to the board for mandatory mitigation
-
D
Require external auditors to determine the appropriate response