Shifting liability for paying a loss before it occurs is about transferring the financial responsibility for those losses to another party through an agreement ahead of time. This is best described by Transfer of Financial Responsibility, which explicitly conveys that one party accepts the costs of specified risks before any incident happens. The other terms focus on post-loss actions or funding: waiver of subrogation and subrogation release limit or end the insurer’s right to seek recovery after a loss, while external funding refers to obtaining money from outside sources to cover losses, which may occur after the event but doesn’t define an upfront transfer of responsibility.

Risks tied to society and reputation are categorized as social risks. This category covers how social stability, public opinion, media narratives, and stakeholder trust shape an organization’s risk profile, including potential impacts on legitimacy and license to operate. The term describes the domain where perceptions and societal dynamics drive risk, not financial upsides, physical assets, or purely financial calculations. The other options don’t fit this social, reputational focus: speculative risk involves uncertain gains or losses, tangible property refers to physical assets, and the TVOM calculation is a financial metric rather than a risk category.

Risk management aims to balance risk and opportunity so the organization can pursue its goals safely and effectively. The primary purpose of a risk management program is to reduce the organization’s exposure to risk to an acceptable level while enabling objectives. This means applying a structured process to identify, assess, treat, monitor, and review risks so that the remaining, or residual, risk stays within what the organization is willing to accept. It recognizes that some risk is inherent when pursuing opportunities and that elimination is usually impractical and wasteful. This approach supports decision-making and strategy by aligning risk treatment with the organization’s risk appetite, using controls, resources, and monitoring to protect assets, people, and operations while still enabling desired outcomes. It’s not about eradicating all risk, and not solely about chasing profits or focusing only on regulatory compliance; compliance is important, but the program’s scope is broader, aiming to manage risk in a way that supports objectives.

The main idea here is creating recoverable copies of data and system configurations so you can restore operations after a loss or disruption. Backups are planned, versioned copies stored separately from the live environment, with defined retention and tested restore procedures to ensure you can recover to a known good state. This focus on recoverability and formal restoration distinguishes backups from other concepts: redundancy is about having spare components to keep services running, replication is often a real-time copy for availability, and duplication is a broad term for copying data without the explicit recovery and versioning framework that backups provide. Because the goal is to be able to restore critical systems or data after an incident, the best description is backup.