Risk Response Options and Strategies: Avoid, Transfer, Mitigate, Accept

Risk response is the plan you put in place after you have identified a risk and worked out how big it is. In CRISC, there are exactly four response options: avoid, transfer, mitigate, and accept. Each one is a different way of handling a potential problem. You will hear the mnemonic 'ATMA' in some study circles, which stands for avoid, transfer, mitigate, accept.

Avoid means eliminating the activity that creates the risk. It is the most extreme response. If a new software project is too risky because nobody on the team has the right skills, the organisation could decide not to do the project at all. Avoid does not reduce the risk — it removes it completely. But it also means losing the benefit that the activity would have brought.

Transfer means shifting the financial impact of the risk to another party. The most common example is insurance. A company buys a cyber insurance policy. If a data breach happens, the insurance company pays for the investigation, legal costs, and notification letters. The risk of a breach still exists, but the financial hit is passed to the insurer. Another example is outsourcing — hiring a cloud provider to run your servers. The cloud provider takes on the risk of hardware failure, but the organisation still owns the data and the reputation risk.

Mitigate means taking action to reduce the likelihood or the impact of a risk. This is the most common response. You cannot make a risk go away completely, but you can make it much less dangerous. For example, an organisation might install anti-virus software on all laptops. That does not stop every virus, but it reduces the chance of a successful attack. Mitigation can be technical, like adding a firewall, or procedural, like requiring two people to authorise a large payment.

Accept means acknowledging the risk and consciously deciding to take no action. This is not ignoring the problem. The organisation has evaluated the risk and decided that the cost of fixing it is higher than the potential damage it could cause. For example, a small company might decide not to invest in a backup generator. The risk of a power outage is real, but the cost of a generator is not worth it for a business that only loses a few hundred pounds of work per outage. Acceptance is a deliberate, documented decision.

Choosing the right response depends on the risk appetite of the organisation. Risk appetite is the amount of risk the organisation is willing to take on to achieve its goals. A bank has a very low risk appetite for losing customer money, so it will probably avoid or mitigate those risks heavily. A startup might have a higher appetite and accept risks that a bank would not.

Risk response options are not mutually exclusive. You can mitigate a risk and also transfer part of it. For example, a company installs a security system (mitigate) and buys cyber insurance (transfer). You could even accept a small residual risk after mitigating the rest.

The key idea is that every response has a trade-off. Avoid loses opportunity. Transfer costs a premium. Mitigate costs time and money to implement. Accept leaves you exposed to the full impact. The skill in risk management is balancing these trade-offs to match the organisation's appetite.

An IT risk manager at a mid-sized e-commerce company discovers that the website's payment processing system has a critical vulnerability. An attacker could steal credit card numbers. The manager follows a structured process to decide how to respond.

First, the manager assesses the risk. The likelihood of an attack is high because the vulnerability is known in hacker forums. The potential impact is also high — fines from regulators, loss of customer trust, and legal fees. The risk score is critical. The manager then presents the four options to the company's leadership. - Avoid: The manager recommends taking the payment page offline entirely until the vulnerability is patched. This stops the risk cold. The downside is that the company stops making sales for a few days. Leadership rejects this because the loss of revenue is too great. - Transfer: The manager checks whether the company's cyber insurance policy covers this scenario. It does, but only for third-party claims. The company still has to pay its own investigation costs. The manager also considers hiring a specialist security firm to handle the forensic investigation if a breach occurs. That would transfer the technical work, but not the legal responsibility. - Mitigate: The manager finds that a simple patch is available from the payment software vendor. The IT team can apply the patch in four hours. The manager also adds web application firewall rules to block common attack patterns. These actions reduce the likelihood of a successful attack from high to low and reduce the impact because the patch closes the main entry point. - Accept: The company could do nothing. The risk is known, but the cost of patching (labour time and potential downtime) is judged to be lower than the expected loss. The manager documents this decision with the signature of the chief financial officer.

In this real scenario, the manager chose to mitigate. The patch was applied, the firewall was updated, and the company also kept its insurance in place as a backstop. The manager then scheduled a follow-up review in one month to ensure the mitigation was effective.

Every step of this process is documented. The risk register — a formal log of risks — now shows the decision, the rationale, and the chosen response. This documentation is critical for auditors and for the CRISC exam, which tests your ability to trace the logic from risk identification through to response.