When a risk cannot be sufficiently mitigated through manual or automatic controls, which of the following options will best protect the enterprise from the potential financial impact of the risk?

a) Insuring against the risk
b) Updating the IT risk registry
c) Improving staff training in the risk area
d) Outsourcing the related process to a third party