Risk Treatment and Control Design
Treatment options
Four canonical responses exist: avoid (exit the activity), reduce/mitigate (add controls), transfer/share (insurance, outsourcing, contracts), and accept (retain, with documented rationale and authority). A fifth, exploit, applies to upside risk. Traps appear when transfer is treated as eliminating risk - insurance transfers financial consequence, not accountability or reputational harm. Acceptance must be explicit, documented, and within the owner's delegated authority; silent acceptance is a finding.
Designing controls
Good control design matches the control to the risk, is proportionate, and considers cost versus benefit. Candidates should understand the control hierarchy: eliminate, substitute, engineer, administrate, and personal protective equipment - engineering controls are generally stronger than administrative ones. For each key control, define the owner, frequency, evidence, and the test that proves it operates. Distinguish design effectiveness (would the control achieve the objective if operated as intended?) from operating effectiveness (did it actually operate?). A control can be well designed but poorly operated.
Control testing and monitoring
Key risk indicators (KRIs) provide early warning; key control indicators (KCIs) evidence control performance; key performance indicators (KPIs) measure business outcomes. Testing may be walkthrough, sample-based, or full-population analytics. Sampling risk and the need for sufficient, appropriate evidence are recurring themes.
Worked example
A firm cannot eliminate fraud in expense claims, so it adds manager review (detective, manual) and automated policy rules (detective, automated). It retains residual risk within tolerance and documents acceptance signed by the CFO. Rule of thumb: every accepted risk needs a named approver, a rationale, and a review date.