A manufacturer outsources its payroll processing to a third party to reduce its own handling of sensitive employee data. Which combination most accurately characterizes this in risk-treatment terms?

• A.Pure retention, given that outsourcing changes nothing and the organization still owns the entire risk without any transfer
• B.Pure avoidance, given that the company no longer processes payroll and has fully exited that entire business function
• C.Sharing the risk with the provider, while retaining accountability and residual third-party risk that must itself be treated
• D.Modification alone, given that a control was added and residual risk assumed fully eliminated