Risk treatment, acceptance and reporting
Choosing and communicating a response
Every assessed risk receives one of four responses. Avoid eliminates the activity creating the risk. Mitigate applies controls to reduce likelihood or impact. Transfer shifts financial consequence to a third party through insurance, contracts, or outsourcing. Accept retains the risk, which is legitimate only when residual risk sits inside the stated appetite and the accountable risk owner formally documents the decision. Responses are selected on cost-benefit: a simple financial comparison considers expected loss reduction and control cost, while legal duties, uncertainty and nonfinancial effects may also govern the choice, and controls should be matched to the risk (preventive to stop, detective to discover, corrective to recover).
Reporting closes the loop. Reporting to the board is summarized, trend-oriented, and framed against appetite; operational reporting is detailed and action-oriented. Effective reporting uses key risk indicators with defined thresholds, exceptions, and status of remediation, plus escalation paths when tolerance is breached. Risk reporting must be timely, comparable across periods, and traceable to the register.
Traps
Test writers favor three errors. First, treating transfer as elimination: insurance or contract terms can allocate specified financial consequences but do not automatically remove operational, reputational or legal exposure or the organization’s own duties. Second, allowing acceptance by someone without authority, or accepting a residual risk above appetite without escalation. Third, over-reporting: dumping the full register on the board signals poor aggregation, not diligence. Also watch for controls that reduce likelihood being credited with reducing impact, or vice versa.
Rule of thumb
Acceptance is valid only when residual risk is within appetite and the authorized owner signs off; otherwise escalate or choose another response. Every accepted risk needs a review date.
Worked example. A payment platform faces $500,000 annualized loss from fraud. A monitoring control costing $80,000 annually reduces expected loss to $90,000: mitigate, since the benefit far exceeds cost. A residual $90,000 above the unit's $50,000 tolerance must be escalated or insured, not silently accepted.
A risk response needs an accountable owner, an implementation plan and evidence of effectiveness. Compare estimated outcomes using a consistent time horizon and state uncertainty. If a mandatory requirement applies, an internal financial preference does not waive it. Review accepted risks when assumptions, controls, exposure or business impact change rather than treating a signature as a permanent exemption.