Risk Mitigation Strategies: The 4 Types, With Examples
Maxim Atanassov •
There are four risk mitigation strategies: avoid the risk, reduce it, transfer it, or accept it. Avoid means stop the activity that creates the risk. Reduce means add controls that cut its likelihood or its impact. Transfer means move the financial consequence to someone else, usually an insurer or a contractor. Accept means keep the risk, knowingly, because it sits within your risk appetite. Every response a risk owner chooses is one of these four, or a mix of them.
The four strategies at a glance
| Strategy | What you do | When it fits | Example |
|---|---|---|---|
| Avoid | Stop or never start the activity | The risk exceeds your appetite and no control brings it within it | A software company decides not to enter a market whose courts do not enforce intellectual property rights |
| Reduce | Add controls that lower likelihood, impact or both | The activity is worth doing and controls cost less than the expected loss | A retailer adds a second supplier for its top 20 products to cut the impact of a supplier failure |
| Transfer | Move the financial loss to another party | The loss is large, rare and insurable, or a partner manages it better | A contractor buys liability insurance and requires subcontractors to carry their own |
| Accept | Keep the risk and monitor it | The risk sits within your appetite, or treating it costs more than it saves | A company accepts minor defects in an internal tool to meet a launch date, and logs them for the next release |
"Risk mitigation" is used in two ways. Broadly, it means all four responses. Narrowly, especially in project management, it means only the second: reducing the risk. This article uses the broad meaning and calls the second strategy "reduce."
1. Avoid
Avoidance removes the risk by removing the activity. It is the only strategy that takes the risk to zero, and it has a price: you also give up the reward. Use it when a risk is severe, you cannot control it, and the activity is not central to your strategy.
Examples: exiting a product line with unmanageable liability; declining a contract with uncapped penalties; refusing to store payment card data by using a payment processor that holds it instead.
2. Reduce
Reduction is the strategy most organizations use most often. You keep the activity and add controls. Some controls lower the likelihood that the risk occurs (preventive controls); others lower the damage when it does (detective and corrective controls).
Examples:
- Likelihood: multi-factor authentication, segregation of duties, preventive maintenance, supplier due diligence.
- Impact: backups and a tested recovery plan, a second supplier, safety stock, a crisis communication plan.
The test for a reduction is cost. A control that costs more each year than the expected loss it prevents destroys value. When that happens, transfer or accept.
3. Transfer
Transfer moves the financial consequence of a risk to another party. The usual tools are insurance, contracts (indemnities, limitation of liability clauses, fixed-price contracts) and outsourcing to a specialist. ISO 31000 and COSO call this strategy "sharing," because you rarely transfer all of it: deductibles, policy limits and exclusions leave part with you.
Transfer moves the money, not the responsibility. If a cloud provider loses your customers' data, the customers and the regulator still hold you accountable. See our guide to cyber risk and insurance.
4. Accept
Acceptance is a decision, not neglect. You accept a risk when it falls within your risk appetite, or when every other response costs more than the risk. ISO 31000 phrases it well: "retaining the risk by informed decision." An accepted risk still needs an owner, a limit and a trigger that sends it back for review if it grows.
Examples: self-insuring small property losses; keeping a legacy system for one more year with extra monitoring; accepting currency exposure below a set threshold.
How the frameworks name the strategies
The four strategies appear under different names in the main standards. The differences explain why some sources list five or seven.
| Four strategies | ISO 31000:2018 (risk treatment, clause 6.5.2) | COSO ERM (2017) | PMI, threats (PMBOK Guide, 6th ed.) |
|---|---|---|---|
| Avoid | Avoiding the risk | Avoid | Avoid |
| Reduce | Removing the risk source; changing the likelihood; changing the consequences | Reduce | Mitigate |
| Transfer | Sharing the risk | Share | Transfer |
| Accept | Retaining the risk by informed decision | Accept | Accept |
| Not one of the four | Taking or increasing the risk to pursue an opportunity | Pursue | Escalate |
Two additions matter. COSO's pursue and ISO's taking or increasing the risk treat risk as a source of value: you take on more risk because the return justifies it. PMI's escalate sends a threat outside the project manager's authority to the person who owns it, such as the sponsor or the portfolio board.
How to choose a strategy
- Assess the risk. Rate its likelihood and impact before any new control. Our guide to risk assessments covers the methods.
- Compare it with your appetite. If it sits inside your appetite and tolerance, accept it and monitor it.
- Ask whether the activity is worth it. If the risk is outside appetite and the activity is not essential, avoid it.
- Price the controls. If controls bring the risk within appetite for less than the expected loss, reduce it.
- Transfer the remainder. Insure or contract away the severe, rare losses that controls cannot cover.
- Assign an owner and a date. Every response needs a person accountable for it, and a date to check that it works.
Most significant risks need more than one strategy. You reduce what you can, transfer the tail, and accept what is left.
A worked example: a ransomware attack
A distribution company with $200 million in revenue rates ransomware its top operational risk: a two-week outage would stop shipments and could cost about $8 million.
| Strategy | Response | Effect |
|---|---|---|
| Avoid | Not possible: the business runs on its systems | None |
| Reduce (likelihood) | Multi-factor authentication, patching within 14 days, phishing training | Fewer successful intrusions |
| Reduce (impact) | Immutable offline backups, a recovery plan tested twice a year | Outage cut from two weeks to three days |
| Transfer | Cyber insurance with a $5 million limit and a $250,000 retention | Most of the remaining loss moved to the insurer |
| Accept | The $250,000 retention and losses above the limit, within the board's appetite | Residual risk owned by the CFO, reviewed quarterly |
The board sees one risk, four responses and a residual risk inside its appetite. (The figures are illustrative.)
Common mistakes
- Treating acceptance as doing nothing. An accepted risk without an owner and a limit is an ignored risk.
- Assuming insurance solves the problem. Policies exclude, cap and delay. Read the exclusions before you count on the cover.
- Adding controls without pricing them. Controls cost money and slow the business. Match each control to the size of the risk.
- Treating every risk the same way. Prioritize first. See our strategies to prioritize risk.
- Never testing the response. A recovery plan nobody has rehearsed is a document, not a control. A tabletop exercise tests it cheaply.
Frequently asked questions
What are the four types of risk mitigation?
Avoid, reduce, transfer and accept. Some sources call them the four risk treatments or risk responses.
What are the five risk mitigation strategies?
Lists of five usually add one strategy to the four. COSO adds "pursue," taking on more risk for a greater return. PMI adds "escalate," passing a threat to the person with the authority to manage it.
What is the difference between risk mitigation and risk management?
Risk management is the whole cycle: identify, assess, respond, monitor and report. Risk mitigation is the response step.
What is an example of risk mitigation?
A company that installs multi-factor authentication to cut the likelihood of an account takeover is reducing a risk. One that buys cyber insurance is transferring it.
What is residual risk?
The risk that remains after your responses. The board's question is whether residual risk sits within its appetite.
