Risk Treatment and Control
Core idea
Treatment converts assessment into action. Candidates must know the standard option set: avoid, reduce (mitigate), transfer, and accept, with some frameworks adding exploit or share for opportunities. Be able to match options to circumstances: avoidance where exposure exceeds capacity and the activity is not essential; reduction through preventive and detective controls; transfer through insurance, contracts or outsourcing (noting that transfer moves financial consequence, rarely accountability); acceptance with documented authority.
Control concepts
Understand the control hierarchy: eliminate, substitute, engineer, administrate, then personal protective equipment, and why higher-order controls are more reliable. Distinguish preventive, detective and corrective controls, and manual versus automated. Know the components of a control: design, implementation and operating effectiveness, and that a poorly designed control cannot be rescued by testing. Understand defence in depth and the risk of single points of failure.
Traps
Questions often present 'transfer' as eliminating risk; it does not, and reputational or regulatory consequences usually stay. Another trap is accepting a control as effective because it exists on paper. Watch also for control overlap creating false comfort, and for treatment plans without an owner, due date or success measure.
Worked rule of thumb
For every proposed control, ask three questions: does it address the cause or only the symptom; can it be evidenced when operating; and what is its residual risk after failure of that control? A treatment plan should read as an action with an accountable owner, a deadline, a cost and a defined target residual score.