This study is concerned with abstract models of randomized response procedures as follows: each individual of the population is assumed to belong to exactly one of the subgroups A1, A2, ..., A,. Observations of discrete random variables X1, X2, ..., X, are made available, and an individual in Ai is to report the value of Xi: let Z be the reported response. Assume simple random sampling with replacement, and independence of the X variables between individuals. The following assumption' is made throughout: if Pj (z) >0 for some j and z, then P, (z) >0. In this case a design can be represented as a set of points (g, (z), ..., gp (z)) in (p 1)-space each with corresponding weight P, (z); here gi (z) = Pj (z)/PP (z). Define an internal point of a design as one which is not an extreme point in the usual sense applied to convex sets: a point is internal if it is a convex combination of others in the design. For a given design, let the risk to an individual in A be measured by R = max P (A i I Z = z) as z varies, and the risk of a design by the vector (R1, ..., RP_1,) or (R1, ..., R,) according to whether we are in Case I (category A, is unembarrassing) or Case II (all categories embarrassing). For general p and unknown nCi only a little more progress can be made. For p = 2, however, it follows that for a given risk as defined above an optimal design exists which can be realised by an unrelated question procedure: in Case I, the usual one considered, the unrelated question should imply the answer yes (the respondent belongs to the sensitive category) with certainty. This is in contrast to earlier recommendations. For nr known exactly, which may sometimes be a convenient assumption during the design stage, the results simplify greatly.