Risk Response and Reporting
Choosing and communicating a response
Every assessed risk receives one of four responses. Avoid eliminates the activity creating the risk. Mitigate applies controls to reduce likelihood or impact. Transfer shifts financial consequence to a third party through insurance, contracts, or outsourcing. Accept retains the risk, which is legitimate only when residual risk sits inside the stated appetite and the accountable risk owner formally documents the decision. Responses are selected on cost-benefit: the control should cost less than the expected loss it removes, and controls should be matched to the risk (preventive to stop, detective to discover, corrective to recover).
Reporting closes the loop. Reporting to the board is summarized, trend-oriented, and framed against appetite; operational reporting is detailed and action-oriented. Effective reporting uses key risk indicators with defined thresholds, exceptions, and status of remediation, plus escalation paths when tolerance is breached. Risk reporting must be timely, comparable across periods, and traceable to the register.
Traps
Test writers favor three errors. First, treating transfer as elimination: insurance moves financial loss, not reputational damage, regulatory penalty, or accountability. Second, allowing acceptance by someone without authority, or accepting a residual risk above appetite without escalation. Third, over-reporting: dumping the full register on the board signals poor aggregation, not diligence. Also watch for controls that reduce likelihood being credited with reducing impact, or vice versa.
Rule of thumb
Acceptance is valid only when residual risk is within appetite and the authorized owner signs off; otherwise escalate or choose another response. Every accepted risk needs a review date.
Worked example. A payment platform faces $500,000 annualized loss from fraud. A monitoring control costing $80,000 annually reduces expected loss to $90,000: mitigate, since the benefit far exceeds cost. A residual $90,000 above the unit's $50,000 tolerance must be escalated or insured, not silently accepted.