You are the lead auditor of the courier company SpeeDelivery. You have carried out a risk analysis and now want to determine your risk strategy. You…

The strategy described is a combination of risk treatment (for large risks) and risk acceptance (for small risks). The specific act of deciding not to take measures for small risks, following a risk analysis, is known as risk acceptance, risk retention, or risk bearing. This is an informed and deliberate decision to accept the consequences if a small risk materializes, often because the cost of implementing controls outweighs the potential impact of the risk. This is a standard and valid risk treatment option within the ISO 27001 framework.

B. Risk avoidance: This strategy involves deciding not to start or to discontinue the activity that creates the risk. The company is not stopping its activities; it is managing risks within them.

C. Risk neutral: This describes an attitude or appetite for risk (indifference between a certain outcome and a gamble of equal expected value), not a specific risk treatment action or strategy.

D. Risk skipping: This is not a recognized term in formal risk management standards like ISO 27001 or ISO 31000. It implies ignoring risk, which is different from a conscious, informed decision to accept it.

---

1. ISO/IEC 31000:2018, Risk management — Guidelines.

Section 6.5.2, "Selection of risk treatment options," lists "retaining the risk by informed decision" as a primary option. This is synonymous with risk bearing or acceptance. The standard clarifies this is a valid choice after analyzing the risk.

2. ISO/IEC 27005:2022, Information security, cybersecurity and privacy protection — Guidance on managing information security risks.

Section 8.4, "Risk treatment option determination," explicitly lists "Risk retention" as one of the four main options. It states, "Risk retention means that the decision is taken to accept a risk." The scenario's decision not to treat small risks falls directly under this definition.

3. Sienou, A., & Tondel, I. A. (2021). A Metamodel for Information Security Risk Management Methods. In Model and Data Engineering (pp. 139-150). Springer, Cham.

Page 142, Section 2.2, "Risk Treatment": This academic paper, reviewing risk management methods including those aligned with ISO standards, identifies "Risk Acceptance (or retention)" as a core treatment strategy where "no measure is taken to treat the risk." This directly supports the answer. DOI: https://doi.org/10.1007/978-3-030-78428-712