What is the primary purpose of a risk treatment step?

• A. Increase risk exposure for testing
• B. Implement controls to mitigate risk
• C. Remove all controls to simplify operations
• D. Audit entire system

Answer: (B)

Risk treatment focuses on implementing controls to reduce risk to an acceptable level. After risks are identified and assessed, the next step is to choose and put in place safeguards that lower either the likelihood of the risk occurring or the impact if it does. This is why the option describing implementing controls to mitigate risk is the best choice. It directly addresses protection and reduction of risk through concrete measures like policies, procedures, technical safeguards, and monitoring. The other options describe increasing exposure, removing protections, or simply auditing, none of which achieves risk reduction through practical safeguards.