Treat the risk
An unacceptable risk requires treatment. The objective of this stage of the risk assessment process is to develop cost effective options for treating the risks. Treatment options (cf. Fig. 5), which are not necessarily mutually exclusive or appropriate in all circumstances, are driven by outcomes that include:
− Avoiding the risk,
− Reducing(mitigating) the risk,
− Transferring(sharing) the risk,and
− Retaining(accepting) the risk.
Avoiding the risk - not undertaking the activity that is likely to trigger the risk.
Reducing the risk - controlling the likelihood of the risk occurring, or controlling the impact
of the consequences if the risk occurs.
Factors to consider for this risk treatment strategy include:
− Can the likelihood of the risk occurring be reduced? (through preventative maintenance, or quality assurance and management, change in business systems and processes), or
− Can the consequences of the event be reduced? (through contingency planning, minimizing exposure to sources of risk or separation/relocation of an activity and resources).
Examples for the mitigation activity effectiveness are described in (Wirthin 2006).
Transferring the risk totally or in part -This strategy may be achievable through moving the responsibility to another party or sharing the risk through a contract, insurance, or partnership/joint venture. However, one should be aware that a new risk arises in that the party to whom the risk is transferred may not adequately manage the risk!
Retaining the risk and managing it - Resource requirements feature heavily in this strategy.
The next step is to determine the target level of risk resulting from the successful implementation of the preferred treatments and current control activities.
The intention of a risk treatment is to reduce the expected level of an unacceptable risk. Using the risk matrix one can determine the consequence and likelihood of the risk and identify the expected target risk level.