In risk management, is it true that a risk must be mitigated at any cost?

• A. True
• B. False
• C. Only for high-risk scenarios
• D. Not applicable

Answer: (B)

In risk management, you don’t mitigate at any cost. The key idea is to reduce risk to an acceptable level using controls that are feasible and cost-effective. Resources are finite, so you compare the effort, expense, and operational impact of a mitigation with the benefit of lowering the risk. When the cost or disruption of further controls would exceed the value gained from reducing the risk, you stop, accept the residual risk, or consider other approaches like transferring or avoiding the risk. This approach also recognizes risk tolerance and thresholds set by the organization.

For example, implementing every possible safeguard across all systems might be prohibitively expensive and offer diminishing returns. You prioritize high-impact, high-probability risks and apply proportionate controls, while acknowledging some residual risk remains. That’s why the statement is not correct: risk mitigation is balanced—not performed at any cost.