Risk Treatment, Mitigation, and Control
Treatment options
The standard treatment set is avoid, reduce, transfer, and accept, with exploit or enhance sometimes added for upside risk. Avoidance removes the activity; reduction adds preventive or detective controls; transfer shifts financial consequences through insurance, hedging, or outsourcing; acceptance requires documented authority within appetite. A frequent trap is treating outsourcing as elimination of risk; it converts operational risk into vendor and concentration risk.
Control design
Controls are preventive, detective, or corrective, and may be manual or automated. Candidates should understand the control hierarchy: eliminate the hazard, substitute, engineer controls, then rely on administrative controls and protective equipment. Key controls are those that materially affect the residual rating and must be tested. Segregation of duties, authorisation limits, reconciliation, and exception reporting are core examples.
Cost, proportionality, and residual risk
Treatment decisions compare the cost of control with the reduction in expected loss. Over-control creates cost and friction; under-control breaches appetite. Residual risk must be recalculated after treatment and accepted by the accountable owner.
Worked example
A firm faces fraud losses with expected loss of 2 million per year. A new automated detection system costs 400,000 annually and is expected to cut losses by 60%, saving 1.2 million. Net benefit is 800,000, so the control is justified. If it only cut losses by 15%, saving 300,000, the cost would exceed the benefit and acceptance with monitoring would be the better documented decision.