Risk management strategies are the responses an organisation chooses after assessing a risk. Four common options are to tolerate it, treat it, transfer part of the exposure or terminate the activity that creates it. These are often called the four Ts.

The best strategy depends on the objective, the potential consequences, existing controls and the organisation’s risk appetite. A single risk may need a combination of responses.

The four risk management strategies

1. Tolerate: accept and monitor the risk

Tolerating a risk means making an informed decision to accept the remaining exposure. This can be appropriate when it falls within agreed appetite and existing controls are sufficient.

For example, an organisation might accept occasional minor delays to a non-critical internal service where the consequences are limited and further controls would add little value.

Acceptance should be recorded with an owner, the reason for the decision and a review date. Agree what would trigger a different response, such as a rise in the frequency or impact of incidents. Accepting a risk does not mean forgetting it.

2. Treat: reduce the likelihood or impact

Treating a risk means introducing or improving controls to reduce the chance of an event, its consequences, or both. It is often described as risk mitigation or risk reduction.

For example, a team concerned about disruption from a single supplier could assess alternatives, review stock arrangements and develop a continuity plan. Each action addresses a different part of the exposure.

Choose controls that address the cause or consequence you have identified. Give actions an owner and a due date, then check whether they reduce the remaining risk. Consider their cost, practicality and any new risks they introduce, alongside the organisation’s duties and objectives.

3. Transfer: share defined aspects of the exposure

Transferring risk means arranging for another party to bear specified aspects of an exposure. Insurance is a familiar example: cover may meet defined financial losses, subject to its terms, limits and exclusions.

A transfer arrangement does not remove every consequence. An insured disruption may still affect service delivery, staff workload and reputation. Those exposures need their own controls and contingency plans.

Outsourcing also needs careful assessment. A specialist provider may help manage an activity, but engaging it does not automatically transfer all the risks or responsibilities. Review dependencies, contractual arrangements and what happens if the provider cannot deliver.

4. Terminate: avoid the activity creating the risk

Terminating a risk means stopping, declining or redesigning the activity that gives rise to it. This is also called risk avoidance.

For example, an organisation might decide not to launch a project when the exposure remains unacceptable and a workable treatment is unavailable. It could also change the project’s scope to remove the part creating the risk.

Consider the consequences of stopping as well as continuing. Ending an activity may create transition costs, affect people who rely on the service or introduce new dependencies. Plan the change and record why it is the appropriate response.

How to choose the best strategy

Start with the assessment, rather than a preferred solution. Work through these questions with the risk owner and the people responsible for the activity:

  • What is at stake? Identify the objective and the people or services that could be affected.
  • What exposure remains? Assess existing controls and the evidence behind the current rating.
  • Is it within appetite? Compare the remaining risk with agreed thresholds and escalation rules.
  • What can each response achieve? Consider feasibility, resources, dependencies and consequences.
  • Who can approve the decision? Refer matters beyond the owner’s authority to the appropriate management or governance level.
  • How will it be reviewed? Set measures, review dates and triggers for changing course.

There is no universally best strategy. A low-level exposure may be accepted; a critical service may need stronger controls and contingency arrangements; a proposed activity may need to be reconsidered altogether.

Combine strategies where the risk requires it

An organisation managing a risk of premises damage might maintain equipment to reduce the likelihood, prepare alternative working arrangements to limit disruption and insure specified losses. It may then accept a defined level of residual exposure.

Record how those responses work together. Insurance cannot demonstrate that a maintenance control is effective, and completing a continuity plan does not show that people can use it. The evidence should match the control being relied on.

Turn the decision into an action plan

A strategy becomes useful when it is part of the risk management process. Record the chosen response, the decision-maker, action owners, completion dates and the exposure expected to remain.

Review the result after the actions are completed and whenever the circumstances change. If the response is not working, reassess it rather than retaining a lower rating without supporting evidence.

For organisations coordinating risks across departments, enterprise risk management software can help keep assessments, responsibilities and actions in one place. Clear ownership and regular review are what make the strategy work in practice.