Which of the following situations demonstrates that management opted to transfer the risk instead of...

Outsourcing the server and data center management function transfers or shares defined elements of operational risk with an external service provider through contractual arrangements. The organization remains accountable for overseeing the outsourced activity, but the provider assumes responsibility for performing specified services and managing associated risks. Option A represents risk avoidance because management stops the activity that creates the exposure. Selling the foreign business unit in option C also removes exposure by exiting the activity and is therefore closer to avoidance. Option D is risk reduction because lower authorization limits are an internal control intended to reduce the magnitude or probability of inappropriate international transactions. Because outsourcing allocates responsibility for performing the activity and managing aspects of its risk to another party, option B best represents risk transfer or sharing.