Which term describes a suitable level of risk commensurate with the potential benefits of the organization's operations as determined by senior management?

• A. Acceptable Risk
• B. Adequate Controls
• C. Availability
• D. Compliance

Answer: (A)

Acceptable risk is the level of risk that leadership is willing to tolerate because the potential benefits justify that exposure. It represents the residual risk remaining after controls are in place and is determined by senior management as part of setting the organization's risk appetite and governance stance. In other words, once the organization weighs costs, benefits, and potential losses, the amount of risk that is considered tolerable, and worth pursuing, is deemed acceptable.

This fits because the term specifically captures the idea of balancing potential benefits with risk exposure and making a judgment call at the top level about what risk level is justifiable. By contrast, adequate controls describes the presence of controls rather than how much risk is acceptable; availability relates to service uptime and accessibility rather than risk tolerance; and compliance focuses on meeting rules and standards, not on the decision about risk Trade-offs.