6.1 The Seven ISO 31000 Risk Treatment Options
Key Takeaways
- ISO 31000:2018 Clause 6.5.2 explicitly outlines seven distinct risk treatment options that can be applied individually or in combination to modify risk profiles.
- Risk treatment is an iterative process that involves selecting one or more options, implementing treatment measures, assessing residual risk, and determining whether residual risk is acceptable.
- Risk sharing (e.g., via insurance, performance bonds, or contractual risk transfer) redistributes financial impact but does NOT transfer ultimate legal, fiduciary, or governance accountability away from the organization.
- Selecting risk treatment options requires balancing potential benefits regarding achievement of objectives against costs, efforts, or disadvantages of implementation.
6.1 The Seven ISO 31000 Risk Treatment Options
Risk treatment is the core operational phase of the ISO 31000:2018 risk management process where decisions are translated into actionable measures. Defined in Clause 6.5, risk treatment involves an iterative process of selecting one or more options for modifying risks, preparing and implementing treatment plans, assessing the effectiveness of that treatment, deciding whether the remaining (residual) risk is acceptable, and taking further treatment if it is not.
Treating a risk does not simply mean eliminating it. Under ISO 31000:2018, risk is defined as the "effect of uncertainty on objectives," meaning risk encompasses both negative threats (downside risk) and positive opportunities (upside risk). Consequently, treatment options are designed to modify risk profiles to optimize organizational outcomes.
The Seven ISO 31000:2018 Treatment Options
ISO 31000:2018 Clause 6.5.2 explicitly identifies seven risk treatment options. These options are not mutually exclusive; organizations frequently combine multiple options to achieve an acceptable residual risk profile.
1. Avoiding the Risk
Avoiding the risk involves deciding not to start or continue with the activity that gives rise to the risk. This option is selected when the inherent risk exposure exceeds organizational risk tolerance and no cost-effective treatment can bring it within acceptable bounds.
- Operational Mechanics: Exiting a volatile geographic market, cancelling a high-risk product development project, or declining a business contract.
- Exam Trap: Avoidance completely eliminates downside exposure, but it also eliminates all potential upside and strategic opportunities associated with the activity. Avoidance should not be confused with risk source removal.
2. Taking or Increasing Risk to Pursue an Opportunity
Taking or increasing risk involves deliberately accepting higher uncertainty or expanding risk exposure to capitalize on strategic opportunities.
- Operational Mechanics: Entering an emerging, unranked international market before competitors, investing heavily in disruptive R&D, or expanding credit terms to capture market share.
- Exam Trap: Risk management is not solely about risk minimization. Candidates must remember that ISO 31000 explicitly advocates taking calculated risks when potential benefits align with strategic objectives.
3. Removing the Risk Source
Removing the risk source eliminates the underlying cause, hazard, or driver of the risk without necessarily cancelling the broader activity or objective.
- Operational Mechanics: Replacing toxic chemical solvents in a manufacturing plant with non-hazardous water-based alternatives, or decommissioning obsolete server hardware that creates cyber vulnerabilities.
- Key Distinction: Unlike risk avoidance (which halts the entire business activity), removing the risk source modifies the operational process so the activity continues without the original hazard driver.
4. Changing the Likelihood
Changing the likelihood involves implementing preventive controls designed to reduce the probability that an adverse event will occur.
- Operational Mechanics: Installing automated fire suppression pre-checks, mandating multi-factor authentication (MFA) across corporate systems, conducting employee safety training, or introducing dual-authorization workflows for financial transactions.
- Focus: Preventive controls alter the frequency or probability of occurrence prior to event manifestation.
5. Changing the Consequences
Changing the consequences involves implementing reactive or mitigating controls designed to reduce the severity, extent, or duration of impact if an adverse event occurs.
- Operational Mechanics: Constructing physical containment dikes around fuel storage tanks, implementing off-site secondary data centers, deploying emergency response protocols, or maintaining redundant supply chain buffers.
- Focus: Mitigating controls focus on post-event impact containment rather than pre-event probability reduction.
6. Sharing the Risk
Sharing the risk involves allocating a portion of the risk exposure to another party or parties through contractual arrangements, insurance, or financial hedging.
- Operational Mechanics: Purchasing commercial insurance policies, executing joint venture agreements, incorporating indemnification clauses in vendor contracts, or utilizing interest rate swaps.
- CRITICAL ISO 31000 EXAM RULE: Risk sharing redistributes financial burdens or operational duties, but ultimate governance, legal, and ethical accountability can NEVER be transferred. The organization remains fully accountable to stakeholders and regulators for the risk outcome.
7. Retaining the Risk by Informed Decision
Retaining the risk involves accepting the residual risk exposure without further active treatment, based on a formal evaluation that the risk falls within organizational risk criteria or that treatment costs outweigh potential benefits.
- Operational Mechanics: Self-insuring small-value equipment losses, setting aside contingency reserves, or formally signing off on minor operational delays.
- Governance Requirement: Risk retention must be an informed decision backed by rigorous risk analysis, clear documentation, and ongoing monitoring.
Comparative Matrix of Risk Treatment Options
| Treatment Option | Primary Objective | Impact Mechanism | Cost / Resource Profile | Typical Operational Application |
|---|---|---|---|---|
| 1. Avoid Risk | Total risk elimination | Cancels activity | High opportunity cost; low ongoing control cost | Exiting high-risk foreign markets |
| 2. Take/Increase Risk | Pursue opportunity | Expands risk exposure | Capital investment; potential for high return | Launching innovative product lines |
| 3. Remove Source | Hazard elimination | Modifies root cause | Upfront process redesign cost | Substituting toxic production chemicals |
| 4. Change Likelihood | Probability reduction | Preventive controls | Continuous operational expenditure | MFA deployment; staff compliance training |
| 5. Change Consequences | Severity reduction | Mitigating controls | Infrastructure capital cost; emergency preparedness | Disaster recovery sites; physical barriers |
| 6. Share Risk | Risk redistribution | Financial transfer | Insurance premiums; contract negotiations | Commercial liability insurance; joint ventures |
| 7. Retain Risk | Conscious acceptance | No active modification | Zero control cost; exposure to full impact | Deductibles; self-insurance contingency |
Iterative Selection & Real-World Integration
Selecting risk treatment options is rarely a single-choice exercise. Organizations frequently deploy hybrid treatment strategies. For example, an enterprise expanding into cloud computing might change likelihood by enforcing zero-trust architecture, change consequences by maintaining daily immutable backups, and share risk by purchasing cyber insurance for catastrophic loss coverage.
Real-World Example: Offshore Energy Platform
An offshore oil exploration firm faces severe hurricane risks.
- The firm cannot avoid offshore operations without abandoning its primary revenue stream.
- It removes the risk source by replacing manual pipe-handling with automated robotic equipment.
- It changes likelihood by establishing real-time meteorological tracking and preventive shutdown protocols.
- It changes consequences by constructing reinforced blast walls and emergency evacuation capsules.
- It shares risk by securing multi-layered offshore property and environmental liability insurance.
- Finally, it retains risk for minor weather delays under five operational days through contingency budgeting.
An enterprise evaluates a high-yield international expansion project. Although the financial downside exceeds risk tolerance, executive management decides to proceed by purchasing political risk insurance and forming a local joint venture to share losses. Under ISO 31000:2018, which statement best characterizes the organization's risk accountability?
A chemical manufacturing plant replaces a highly volatile, toxic solvent with a non-toxic water-based compound across its assembly line. Under ISO 31000:2018, which risk treatment option has been executed?
When evaluating risk treatment options, a risk manager notes that implementing a comprehensive firewall upgrade reduces the probability of a cyber breach but does not eliminate potential financial damage if a breach succeeds. To address the remaining exposure, the organization purchases a cyber insurance policy. Which treatment strategy does this represent?