Risk Treatment and Control
Treatment converts assessment into changed exposure. The exam tests whether you can select options from ISO 31000, justify them against cost and benefit, and state the residual risk and who accepts it.
Options and controls
ISO 31000 treatment options include avoiding the risk, taking or increasing it to pursue opportunity, removing the source, changing likelihood, changing consequences, sharing the risk, and retaining it by informed decision. Controls can be preventive, detective, corrective or directive. Apply a hierarchy: eliminate, substitute, engineer, administer, then PPE - administrative controls and PPE are weakest and most dependent on human behaviour.
Treatment plans
A credible plan names the risk owner, actions, resources, deadlines, performance measures and review points. Test cost against expected loss reduction. “Transfer” through insurance or contracts shifts financial consequences, not accountability, reputation or regulatory exposure.
Worked example
A payments team faces fraudulent supplier payments: inherent likelihood 5, consequence 5, scored 25. Annual expected loss is 0.6 × $2m = $1.2m. Controls: mandatory call-back verification on new bank details (preventive, cuts likelihood to 2) and transaction limits (cuts consequence to $1.5m). Residual annual expected loss is 0.1 × $1.5m = $150k, a reduction of $1.05m against an $80k control cost. Residual score 2×4 = 8, below the appetite limit of 10, so the risk owner accepts it and reports the decision. Reasoning: both likelihood and consequence were targeted; the cost case is explicit; acceptance sits with the accountable owner, not the control designer.
Traps that cost marks
Counting a control as effective because it exists; adding controls without re-scoring residual risk; treating insurance as elimination of risk; defaulting to training and procedures when elimination or engineering is feasible; ignoring secondary risks created by treatment; accepting residual risk above delegated authority; forgetting that opportunities also need treatment (exploit, enhance, share, accept).