Risk Treatment

It follows analysis and evaluation: once a risk is rated against appetite, management decides what to do. The options are to avoid, by not starting or by leaving an activity; to reduce likelihood or impact with controls, which is what risk mitigation usually means; to transfer or share through insurance, hedging or contracts; or to accept, with approval and monitoring, when the risk is within appetite or action costs more than it saves. Some frameworks add taking an opportunity. Treatment plans record the chosen action, owner, cost, deadline and expected effect. What remains afterwards is residual risk, and treatments can create new risks of their own. Project management and ISO 31000 use slightly different names for the options. Until someone chooses and funds one of these options, a rated risk stays on paper exactly as it was.

A ride-hailing firm rates payment fraud on its new app as above appetite. Management weighs four routes: withdraw the app, add one-time passcodes and device checks, buy insurance for losses above a threshold, or accept the loss. It picks the second and part of the third, makes the product head the owner, and sets a three-month deadline.