A dedicated plan which details how organizations are going to deal with risk, both pre-emptively and as incidents occur
Types of risk management strategy
Risk acceptance
Risk transference
Risk avoidance
Risk reduction
Risk acceptance
A risk is accepted with no action taken to mitigate
Risk acceptance approach will not reduce the impact of a risk or even prevent it from happening, but that's not necessarily a bad thing
Sometimes the cost of mitigating risks can exceed the cost of the risk itself, in which case it makes more sense to simply accept the risk
Risk transference
Risk transference is defined as: 'A risk transferred via a contract to an external party who will assume the risk on an organization's behalf
Choosing to transfer a risk does not entirely eradicate it. The risk still exists, only the responsibility for it shifts from your organization to another
Abbie Glosop: '"Transferring risk is not about escaping challenges, but strategically delegating uncertainties to those best equipped to handle them"'
Risk avoidance
A risk is eliminated by not taking any action that would mean the risk could occur
If you choose this approach, you are aiming to completely eliminate the possibility of the risk occurring
Treating risks by avoiding them should be reserved for risks that would have a major impact on your organization if they were to occur
Abbie Glosop: '"Sometimes the greatest risk is not taking one at all. However, wisdom lies in knowing when to navigate the storm and when to seek calmer waters."'
Risk reduction
Risk reduction is when a risk becomes less severe through actions taken to prevent or minimize its impact
Abbie Glosop: '"Risk reduction is the compass that guides us through the uncertainties of life, ensuring a safer passage to success."'
You will need to fully understand each risk your organization faces so that you can choose the appropriate strategy to treat them – whether that's through acceptance, transference, avoidance or reduction