Risk treatment: reduce, avoid, transfer or accept

Treatment is a management decision

After a risk has been assessed, the organisation has to decide what to do about it. Common treatment choices are to reduce the likelihood or impact through controls, avoid the activity creating the risk, transfer or share part of the exposure, or accept the residual risk. These labels are useful, but the real value lies in documenting the reasoning behind the choice.

For example, cyber insurance may transfer some financial consequence but it does not transfer accountability for protecting personal data or maintaining customer trust. Likewise, accepting a risk is not the same as ignoring it. Acceptance should be informed, authorised and periodically reviewed.

Controls should have a clear relationship to the risk

When treatment is to reduce a risk, identify the controls expected to change the exposure. Controls may be preventive, detective or corrective and often work as a set. Multi-factor authentication, privileged access review, logging and incident response may all contribute to a single access-related risk in different ways.

Linking those controls back to the risk makes it easier to explain why the organisation invests in them and to reassess the risk when control performance changes.

Residual risk must be understood after treatment

Controls rarely remove uncertainty completely. Residual risk is the exposure that remains after the selected treatment is considered. Management should decide whether that residual position is acceptable against risk appetite and applicable obligations.

That decision needs ownership. A security team can advise and coordinate, but business risk should be accepted by somebody with the authority to understand the consequence and commit the organisation to the decision.