Risk Treatment

What risk treatment is

Treatment is the "respond" step of the risk cycle. After assessment ranks the risks (Lesson 2), treatment decides what to do about the significant ones. The defining principle of this whole track applies here most sharply: analysis that doesn't lead to action is wasted. Treatment is where the value is realized.

The four threat responses

For threats (downside risks), there are four classic responses — remembered as the "four T's" (terminate, transfer, treat, tolerate) or by these names:

• Avoid — Eliminate the risk by changing the plan so it can't occur — e.g., choose a proven technology instead of an untested one. The most decisive response, where feasible.
• Transfer — Shift the risk to a party better able to bear it — via insurance, a contract clause, or a warranty. The risk remains, but someone else carries its cost.
• Mitigate (reduce) — Lower the probability and/or impact — e.g., extra testing, redundancy, early procurement. The most common response: you can't remove it, so you shrink it.
• Accept — Take the risk knowingly — actively (with a contingency reserve set aside) or passively (just monitor). The right choice for low risks or where treatment costs more than it saves.

Treating opportunities

Risk runs both ways (Foundations), so opportunities (upside risks) get their own mirror-image responses — too often forgotten in practice:

Making treatment stick

For each significant risk, choose a response, assign an owner accountable for executing it, set a due date, and track it to completion in the risk register. Then re-assess the residual risk — what's left after treatment — because no treatment is perfect and the leftover exposure is what your contingency must cover.

Ten things to remember

1. Risk treatment selects and implements responses — the "respond" step of the cycle.
2. Analysis without action is wasted — treatment is where value is realized.
3. Four threat responses: avoid, transfer, mitigate, accept.
4. Mitigate is the most common — shrink probability and/or impact when you can't remove it.
5. Treatment must be cost-effective — don't spend more than the exposure it removes.
6. Match effort to priority — reds get active treatment, greens get accepted/monitored.
7. Opportunities have responses too — exploit, share, enhance, accept.
8. Assign an owner and due date to every response — or it won't happen.
9. Re-assess residual risk — what's left after treatment is what contingency covers.
10. Treatment links risk to contingency — two sides of the same coin.