A risk management program should reduce risk to:

A risk management program should reduce risk to:

A.
zero.

B.
an acceptable level.

C.
an acceptable percent of revenue.

D.
an acceptable probability of occurrence.

Explanation:

Risk should be reduced to an acceptable level based on the risk preference of the organization.
Reducing risk to zero is impractical and could be cost-prohibitive. Tying risk to a percentage of
revenue is inadvisable since there is no direct correlation between the two. Reducing the
probability of risk occurrence may not always be possible, as in the ease of natural disasters. The
focus should be on reducing the impact to an acceptable level to the organization, not reducing the

probability of the risk.