The risk treatment response that should be reflected in the risk register when an IT department decides to keep the data center in-house instead of outsourcing it to an overseas location is risk avoidance. Risk avoidance is a risk response strategy that involves eliminating the source of the risk, or changing the plan or scope of the activity, to avoid the risk altogether. Risk avoidance can help to reduce the risk exposure and impact to zero, by removing the possibility of the risk occurrence. In this case, the IT department avoids the risk of outsourcing the data center to an overseas location, which could involve various threats, vulnerabilities, and uncertainties, such as data security, legal compliance, service quality, communication, or cultural issues. By keeping the data center in-house, the IT department maintains the control and ownership of the data center, and eliminates the potential risk associated with the outsourcing. Risk mitigation, risk acceptance, and risk transfer are not the correct risk treatment responses, as they do not reflect the actual decision and action taken by the IT department, and they do not eliminate the risk source or occurrence. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 51.

The main purpose of selecting a risk response is to mitigate the residual risk to be within tolerance. Residual risk is the risk that remains after applying a risk response. Risk tolerance is the amount and type of risk that an organization is willing to accept in order to achieve its objectives. Risk response is the process of selecting and implementing actions to address risk. The goal of risk response is to reduce the residual risk to a level that is acceptable to the organization and its stakeholders. The other options are not the main purpose of selecting a risk response, although they may be secondary benefits or outcomes. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.1, page 4-23.

Section: Volume A
Explanation:
Systemic risks are those risks that happen with an important business partner and affect a large group of enterprises within an area or industry. An example would be a nationwide air traffic control system that goes down for an extended period of time (six hours), which affects air traffic on a very large scale.
Incorrect Answers:
A: Contagious risks are those risk events that happen with several of the enterprise's business partners within a very short time frame.
B, C: Their scopes do not limit to the important or general enterprise's business partners. These risks can occur with both.
Operational risks are those risks that are associated with the day-to-day operations of the enterprise. It is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events.
Reporting risks are caused due to wrong reporting which leads to bad decision. This bad decision due to wrong report hence causes a risk on the functionality of the organization.