With a completed risk analysis in hand, organisations can then turn their attention to addressing those risks. Risk management is the *process of systematically addressing the risks facing an organisation*. The [[Analysing Risk#Risk Analysis|risk assessment]] serves two important roles in the risk management process: - The **risk analysis** provides guidance in **prioritising** **risks** so that the risks with the highest probability and magnitude are addressed first. - **Quantitative risk analyses** help determine whether the potential impact of a risk justifies the costs incurred by adopting a risk management approach. Risk managers should work their way through the risk assessment and identify an appropriate management strategy for each risk included in the assessment. They have four strategies to choose from: *risk mitigation, risk avoidance, risk transference, and risk acceptance*. ### Risk Mitigation Risk mitigation is the process of **applying security controls to reduce the probability and/or magnitude of a risk**. Risk mitigation is the *most common risk management strategy*, and the vast majority of the work of security professionals revolves around mitigating risks through the design, implementation, and management of security controls. Many of these controls involve engineering *trade-offs between functionality, performance, and security*. ### Risk Avoidance Risk avoidance is a risk management strategy where we **change our business practices to completely eliminate the potential that a risk will materialise**. Risk avoidance may initially seem like a highly desirable approach. After all, who wouldn't want to eliminate the risks facing their organization? There is, however, a major drawback. Risk avoidance strategies typically have a *serious detrimental impact on the business*. ### Risk Transference Risk transference **shifts some of the impact of a risk** from the organisation experiencing the risk **to another entity**. The most common example of risk transference is *purchasing an insurance policy* that covers a risk. When purchasing insurance, the customer pays a premium to the insurance carrier. In exchange, the insurance carrier agrees to cover losses from risks specified in the policy. ### Risk Acceptance Risk acceptance is the final risk management strategy, and it boils down to **deliberately choosing to take no other risk management strategy** and to simply continue operations as normal in the face of the risk. A risk acceptance approach may be warranted *if the cost of mitigating a risk is greater than the impact of the risk itself*. Risk acceptance should not be confused with neglecting the risk. It should be a conscious decision, and in certain cases, mechanisms such as exemptions and exceptions can be employed. For example, *if a particular risk does not align with the established policy but the cost of mitigation is too high*, an exception can be granted for that specific case. This means the organisation acknowledges the risk and has decided to accept it for certain reasons.. Exemptions are similar to exceptions but are generally more formal. They may require a higher level of approval and are often documented to ensure that there is a record of the decision-making process. Exemptions might also have an expiration date and need to be reviewed periodically. >[!Warning] >Risk acceptance is a deliberate decision that comes as the result of a thoughtful analysis. It should not be undertaken as a default strategy. Simply stating that “we accept this risk” without analysis is not an example of an accepted risk; it is an example of an unmanaged risk!