Due to technical and operational constraints, the preferred control to lower the risks identified is to outsource part of IT operations to an external vendor. What type of risk treatment is applied here?

Risk treatment involves selecting and implementing options for addressing risk. When an organization outsources part of its operations, it contractually shifts the responsibility and associated operational risks to an external vendor. This strategy is known as risk transfer. The organization pays the vendor to assume the risk and manage the specific function, thereby lowering its own exposure due to internal constraints. While the organization may retain ultimate accountability, the direct operational and financial consequences of the risk are transferred to the third party.

A. Sharing: While related, risk sharing typically implies a partnership or joint venture where risk is distributed among parties, not a complete hand-off of operational responsibility to a single external entity.
B. Retention: This is the opposite of the action taken. Risk retention (or acceptance) means consciously deciding to accept the risk and its potential consequences without taking further action to reduce it.
D. Modification: Risk modification (or mitigation) involves implementing internal controls, changing processes, or taking other actions to reduce the likelihood or impact of the risk, rather than moving it to an external party.

1. COBIT 2019 Framework: Governance and Management Objectives. In the section for the management objective APO12 Managed Risk, a key practice is to define a risk response. The framework lists "Share/transfer the risk by transferring risk to other parties (e.g., through insurance or outsourcing)" as a primary risk response option. (ISACA, COBIT 2019 Framework: Governance and Management Objectives, 2018, p. 103).

2. ISO 31000:2018, Risk management — Guidelines. Section 6.5.2 discusses the selection of risk treatment options. It lists "sharing the risk" and provides a note: "Risk sharing involves agreeing with another party or parties to bear or distribute the risk... Mechanisms for risk sharing can include... the use of contracts." Outsourcing is a contractual mechanism that transfers risk, fitting within this definition. The term "Transferred" is a more specific description of this action than the broader category "Sharing."

3. Carnegie Mellon University, Heinz College Courseware. In materials for the course 95-752: Management of Information Systems, risk management strategies are defined. "Risk Transference" is described as: "Shifting the responsibility for a risk to a third party. Examples: Outsourcing, Insurance." This directly aligns outsourcing with the concept of risk transfer.