When we operate an organizational information system we are accepting a tolerable level of risk to allow the business functions to operate.
There may be risks you are not qualified to accept or risks you would be better off having undertaken by an outside entity.
A classic example is having your popular web server hosted by a web hosting agency which completely relieves you of the risks associated with that.
Another example is insurance where you offload the risk to an insurance agency and pay them to accept the risk.
When we transfer risk we are giving the risk to someone else to accept and it could be for a number of reasons. Expense primarily but it could also be performance, offers of better service elsewhere, legal reasons and other reasons.
The following answers are incorrect:
-Results of Cost Benefit Analysis: This might be involved in the process of Risk Mitigation but it isn't part of Risk Transference. Sorry, wrong answer.
-Acceptance: This isn't correct because accepting the risk is the opposite of transferring the risk to someone else.
-Not hosting the services at all: Sorry, this defines Risk Avoidance.
The following reference(s) was used to create this question: 2013. Official Security+ Curriculum.

Change management policies and procedures belong to the type of controls that are directive.
Controls are the measures and the mechanisms that are used to protect and safeguard the organization's information systems and assets, and to ensure that they comply with the organization's security and business objectives. Controls can be classified into different types, based on their purpose, function, or nature, such as preventive, detective, corrective, deterrent, compensating, or recovery controls. Directive controls are the type of controls that guide and regulate the actions and the behaviors of the organization's staff, processes, and systems, and that ensure that they follow the organization's policies, standards, and regulations. Directive controls can include policies, procedures, guidelines, standards, rules, regulations, laws, or contracts. Change management policies and procedures belong to the type of controls that are directive, as they provide the instructions and the requirements for managing and controlling any changes to the organization's information systems and assets, and for ensuring that the changes align with the organization's security and business requirements.