The correct answer is D.

The statement 'It is hard to transfer both risk exposure and consequences' is incorrect. In the context of operational risk, external insurance policies are particularly suitable for risks that are predictable and easy to transfer in terms of both risk exposure and consequences. This makes risk mitigation effective for those who take out insurance. The predictability of the risk allows for proper underwriting and pricing by the insurer, ensuring that the risk transfer is beneficial for both parties. Therefore, it is not necessarily hard to transfer both risk exposure and consequences, as the statement suggests.

Choice A is incorrect. The statement accurately represents a consideration in risk transfer. There is indeed a trade-off decision between the insurance premium and the volatility of the risk being insured. Higher volatility risks would typically require higher premiums for coverage.

Choice B is incorrect. This statement correctly highlights that in external insurance, the risk isn't necessarily fully transferred as the amount of compensation depends on the premiums paid. If an event occurs that exceeds the coverage limit set by the premium, then some of that risk remains with the company.

Choice C is incorrect. This statement correctly identifies another potential issue with outsourcing as a strategy for operational risk mitigation - it may result in third-party risks such as vendor or supply chain disruptions, which are outside of direct control by your company.

Things to Remember

• Risk transfer is a key component of risk management strategies, allowing organizations to mitigate potential losses by shifting the risk to another party.
• External insurance involves purchasing insurance policies from third-party insurers to protect against specific risks, such as operational, liability, or property risks.
• Outsourcing refers to the practice of contracting out certain business functions or processes to external vendors or service providers.
• Third-party risk is the potential risk that arises from engaging with external parties.