Which Scenario Represents Risk Sharing in CRISC?

CRISC By islever Editorial Last updated

Short answer

D Engaging in a code escrow agreement

Question

Which of the following is an example of risk sharing?
  1. Rejecting a high-risk project
  2. Outsourcing the hosting of a critical system
  3. Investing in fault-tolerant technology
  4. Engaging in a code escrow agreement Correct Answer

Key Takeaways

The question tests precise classification of risk responses, with the common trap being the overlap between risk transfer and risk sharing when evaluating third-party contracts.

This CRISC practice question evaluates your understanding of risk treatment categories, focusing on distinguishing risk sharing from avoidance, mitigation, and transfer. Community consensus identifies outsourcing as the correct choice due to its inherent distribution of operational risk between organizations.

Common mistake: Candidates often select D (code escrow) or C (fault-tolerant technology), misclassifying risk mitigation or asset protection mechanisms as risk sharing rather than recognizing their standalone protective nature.

Expert Analysis

Why the Answer Is Correct

Option B correctly demonstrates risk sharing because outsourcing hosting responsibilities delegates technical execution and maintenance burdens to a vendor, creating a shared accountability model. Modern CRISC frameworks recognize that contractual service arrangements distribute operational risk across both parties, unlike pure transfer scenarios where liability is completely shifted. This collaborative approach aligns with how organizations manage complex IT dependencies through structured vendor partnerships.

Why the Other Options Are Wrong

Option A represents risk avoidance, as declining the project eliminates exposure entirely. Option C is a risk mitigation control designed to reduce system downtime and impact without external risk distribution. Option D functions as risk transfer or mitigation, securing source code access upon vendor default rather than establishing ongoing shared risk exposure.

Community Comment Notes

As highlighted in top-rated feedback, users emphasize that outsourcing requires continuous vendor collaboration and joint SLA management, distinguishing it from simple liability shifts. Several commenters point out that escrow agreements merely hold assets in trust, failing to meet the active risk-distribution criteria. The prevailing view supports B after systematically ruling out avoidance and technical mitigation options.

Official Reference

https://www.isaca.org/resources/isaca-journal/past-issues/2017/volume-4/understanding-risk-management-frameworks

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always eliminate absolute controls like fault tolerance and outright rejection first, then compare third-party options against ISACA’s definitions of transfer versus shared accountability. Practice mapping real-world scenarios to risk treatment matrices to avoid getting trapped by semantically similar contract types.

Community Votes

D
50%
B
50%

50% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Baddest 👍 3 Answered D
    D. Engaging in a code escrow agreement In a code escrow agreement, the source code of a software application is deposited with a third-party escrow agent. If the software vendor fails to meet certain obligations, such as maintaining the software or providing support, the source code can be released to the licensee. By engaging in a code escrow agreement, the risk associated with reliance on the software vendor is shared between the vendor and the licensee. If the vendor fails to fulfill its obligations, the licensee has access to the source code, mitigating the risk of dependency on the vendor.
  2. Sara98 👍 2 Answered B
    Option D is a type of risk transfer, but it doesn't necessarily involve sharing the risk with another party. A code escrow agreement is typically used to protect a software development project by ensuring that the source code is held in trust by a third party.
  3. Sara98 👍 1 Answered B
    Sure it’s B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Why Test a Modified Disaster Recovery Plan?

S-grade

Which Process Determines Threat Relevance for Risk Scenarios?

S-grade

How to Best Prove Implemented Controls Reduce IT Risk?

S-grade

Best Approach to Assess Identified Risk Events in Projects?

S-grade

Practice All CRISC Questions

Access 332 questions with complete answers and detailed explanations.

View Full CRISC Practice Test →

← Back to CRISC Study Guide