When the costs of protecting against a business risk exceed the cost of the risk multiplied by its probability,an auditor will generally recommend against installing the specific control.

Question

Quizplus · Accepted Answer

This statement describes the concept of cost-benefit analysis in risk management, where controls are only recommended if their cost is justified by the reduction in expected losses. If the cost of a control exceeds the expected loss of the risk, it does not make sense to implement it.

When the Costs of Protecting Against a Business Risk Exceed