Each organization must respond to risks, but there are many alternative ways in which the process used can be applied. Risk must first be identified. Monitoring and review requires measurement of organizational performance. Once risks are identified, responses must be selected. Risks can be mitigated by an implicit trade off between insurance and cost reduction. Most actions available to organizations involve knowing what risks the organization can cope with because of their expertise and capabilities,and which risks they should outsource to others at some cost. Some risks can be dealt with, others avoided.