Implement Control or Avoid, Share, or Accept the Risk
When controls are cost-effective, they should be implemented so that risk can be reduced. Risks that are not reduced must be accepted, shared, or avoided. Companies typically accept risk when it is within the company's risk tolerance. An example would be a risk with a very small likelihood of occurring and whose impact is small. A reduce or share response is used to bring residual risk into an acceptable risk tolerance range An avoid response is typically only used when there is no way to cost-effectively bring risk into an acceptable risk tolerance range.