A conservative company with rigorous risk control plans and internal audit rules has a recurrent...

The company’s response to the vendor’s request is to deny it because of the company’s risk aversion. Risk aversion is the tendency to avoid or minimize exposure to uncertain or potentially negative outcomes. A conservative company with rigorous risk control plans and internal audit rules would be highly risk-averse and would not grant remote access to quality and production data to an external vendor, even if the vendor provides routine maintenance for the core business application. Remote access could pose security, privacy, and compliance risks for the company and its data, and the company would prefer to restrict and control the access and maintenance to be on-site. The company would not accept the vendor’s request, even if the company has an urgent problem to solve or if the immediate remote access could resolve the issue, because the company would prioritize risk mitigation over convenience or efficiency. References:

CBAP / CCBA Certified Business Analysis Study Guide, 2nd Edition, Chapter 7: Solution Evaluation, Section 7.2: Analyze Performance Measures, p. 311-312

A Guide to the Business Analysis Body of Knowledge® (BABOK® Guide), Version 3, Chapter 7: Solution Evaluation, Section 7.2: Analyze Performance Measures, p. 269-270

A Guide to the Business Analysis Body of Knowledge® (BABOK® Guide), Version 3, Chapter 10: Solution Evaluation, Section 10.3: Assess Enterprise Limitations, p. 277-278