Risk Treatment and Mitigation
Risk treatment selects and implements options that modify risk. Candidates must know the canonical options: avoid (eliminate the activity), reduce/mitigate (lower likelihood or impact via controls), transfer (insurance, hedging, outsourcing, contracts), share (joint ventures, partnerships), and accept/retain (with awareness and authority). Exploit, enhance, share, and accept apply to opportunity risks.
Distinguish preventive/detective/corrective controls and directive controls. Understand control design versus operating effectiveness, and the concept of defense in depth and layered controls. Know residual risk after treatment and the requirement to compare it against tolerance and obtain formal acceptance where residual exceeds tolerance. Understand risk transfer does not eliminate risk (counterparty, basis, and moral hazard remain), and that insurance has deductibles, limits, exclusions, and coverage gaps.
Traps: assuming transfer removes risk from the register; treating a control's existence as proof of effectiveness; confusing mitigation (reduce) with avoidance (eliminate); and overlooking secondary risks created by treatment and residual risk acceptance authority.
Rule of thumb: Treat in cost-benefit order: avoid if catastrophic and avoidable; reduce where cost-effective; transfer where priced efficiently; accept only with documented authority. Worked example: a firm faces a $10 million cyber exposure. It buys insurance with a $1 million deductible and $5 million limit (transfer), implements patching and segmentation (reduce), and formally accepts the remaining $4 million residual within its tolerance, documenting the decision.