The organization has adopted the risk treatment of transfer, which means that it has shifted some or all of the potential negative consequences of a risk event to another party, such as a vendor, an insurer, or a partner. By including penalties for loss of availability in the contract, the organization has transferred the financial impact of a service disruption to the vendor, who will be liable for compensating the organization for the loss.
Transfer does not eliminate the risk, but it reduces the organization's exposure to the risk.
References:
*ISACA, Risk and Information Systems Control Review Manual, 7th Edition, 2020, p. 2111
*ISACA, A Nuanced View of Risk Response2

Section: Volume C
Explanation:
When you are hiring a third party to own risk, it is known as transference risk response.
Risk transfer means that impact of risk is reduced by transferring or otherwise sharing a portion of the risk with an external organization or another internal entity. Transfer of risk can occur in many forms but is most effective when dealing with financial risks. Insurance is one form of risk transfer.
Incorrect Answers:
B: The act of spending money to reduce a risk probability and impact is known as mitigation.
C: When extra activities are introduced into the project to avoid the risk, this is an example of avoidance.
D: Exploit is a strategy that may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized.

is incorrect. Assets are economic resources that are tangible or intangible, and is
capable of being owned or controlled to produce value.