Risk Response and Control: Choosing, Costing and Monitoring Treatments
This domain tests your ability to recommend a risk response and evaluate the controls that support it. P3 expects a reasoned choice among alternatives, an honest statement of residual risk, and a cost-benefit view - plus competence in business continuity management.
The response set
For threats: tolerate (accept and monitor), treat (reduce likelihood or impact through controls), transfer (share with insurers, counterparties or outsourcers) and terminate (avoid the activity). For opportunities the parallel responses are exploit, enhance, share and avoid. Responses should be matched to the appetite: a risk scored above tolerance cannot simply be tolerated.
Controls and frameworks
COSO's 2013 internal control framework has five components - control environment, risk assessment, control activities, information and communication, and monitoring activities - supported by seventeen principles. Classify controls as preventive, detective or corrective, and as manual or automated. Typical control activities: segregation of duties, authorisation limits, reconciliations, physical safeguards, and IT general controls over access and change. Transfer does not eliminate risk: insurance leaves deductibles, exclusions, moral hazard and uninsurable exposures such as regulatory fines and reputational damage; outsourcing transfers activity, not accountability, and adds supplier concentration risk.
Business continuity
A business impact analysis identifies critical activities and sets the maximum tolerable downtime, from which a recovery time objective and recovery point objective are derived. The disaster recovery plan covers systems; business continuity covers the whole operation, including people, premises, suppliers and crisis communication. Untested plans are assumptions, not controls.
Worked example
A single-site food manufacturer depends on one packaging supplier and one filling machine. Options: dual-source the packaging (higher unit cost, removes single point of failure), hold four weeks' buffer stock (working capital cost, still vulnerable to a long outage), buy a standby machine (high capital cost, low utilisation), or insure against business interruption (covers loss, not customers). Reasoning: the realistic loss is lost orders and delisting by retailers, so dual-sourcing plus a tested continuity plan reducing downtime to five days is preferred; insurance is retained as a financial backstop for the residual. Residual risk is stated explicitly, with a KRI on supplier lead time.
Traps that cost marks
- Claiming transfer eliminates risk, or that insurance covers fines and reputation.
- Mixing up RTO (time to restore) and RPO (data loss tolerated).
- Treating IT disaster recovery as the whole of business continuity.
- Recommending controls with no cost, owner, or residual risk statement.
- Confusing "tolerate" with "ignore": tolerated risks are monitored against triggers.