Selecting and implementing measures to address identified risks—mitigate, accept, transfer, or avoid.
Risk treatment is the process of selecting and implementing responses to assessed risks. The four treatment options are: mitigate (implement controls to reduce likelihood or impact), accept (acknowledge the risk and do nothing), transfer (shift risk to another party through insurance or contracts), or avoid (eliminate the activity creating the risk). Treatment decisions should be documented, justified, and approved at appropriate levels. Residual risk (remaining after treatment) should be within acceptable tolerance.
Why It Matters
The DSC Perspective:
Risk treatment turns assessment into action. Not every risk needs mitigation—some should be accepted or transferred. Document treatment decisions to demonstrate thoughtful risk management.