Which statement describes the three types of controls and the criterion they must meet?

Which statement describes the three types of controls and the criterion they must meet?

• A. Deterrence; Surveillance; Training; Must be timely and scalable
• B. Avoidance/Elimination; Physical; Educational; Must be suitable, feasible, and acceptable
• C. Administrative; Financial; Technical; Must be approved and funded
• D. Containment; Isolation; Notification; Must be immediate

Answer: (B)

In risk management, controls are ways to reduce or remove risk, and they fall into three broad categories: avoidance or elimination of the hazard, physical controls that create barriers or protections, and educational controls that change behavior or awareness. For a control to be effective, it must be suitable for the risk it’s addressing, feasible to implement with available resources, and acceptable to those affected and to leadership. This combination ensures the control actually reduces risk without creating new problems or burdens. The statement that lists these three types and the criterion they must meet captures this established approach. Other options mix different terms or propose criteria that aren’t the standard acceptance hallmarks (such as focusing on timeliness, on funding, or on immediate actions), so they don’t align with how controls are typically categorized and evaluated.

In risk management, controls are ways to reduce or remove risk, and they fall into three broad categories: avoidance or elimination of the hazard, physical controls that create barriers or protections, and educational controls that change behavior or awareness. For a control to be effective, it must be suitable for the risk it’s addressing, feasible to implement with available resources, and acceptable to those affected and to leadership. This combination ensures the control actually reduces risk without creating new problems or burdens. The statement that lists these three types and the criterion they must meet captures this established approach. Other options mix different terms or propose criteria that aren’t the standard acceptance hallmarks (such as focusing on timeliness, on funding, or on immediate actions), so they don’t align with how controls are typically categorized and evaluated.