Which of the following best describes risk avoidance?

• A. The action that avoids any exposure to the risk whatsoever.
• B. The action of tolerating some level of risk.
• C. The action of transferring risk to a third party.
• D. The action of accepting all risk without action.

Answer: (A)

Risk avoidance means removing the risk source by not engaging in the activity that creates the risk, so exposure is eliminated entirely. In practice, this could mean not deploying a vulnerable service, not using a dangerous tool, or choosing a safer alternative to avoid potential harm altogether. It is the strongest form of control because it guarantees that the risk cannot occur.

Tolerating some risk is risk acceptance, where you accept that some level of risk remains. Transferring risk to a third party is risk transfer, such as insurance or outsourcing. Accepting all risk without action is unmanaged risk or plain acceptance without any mitigation.