Introduction

Having not only identified and analysed risks but also compared the risks faced with the stated risk appetite, the next stage is to respond to those risks. The responses to risk are generally placed into one of four categories:

• reduce;

• remove;

• transfer; or

• accept.

There is little point in trying to fit every potential risk response into one of these categories, since there is often ambiguity over which category a particular treatment should be put. The main purpose of detailing these four groups is to ensure that all potential responses are considered in relation to a risk as it arises.

Risk reduction

Risk reduction involves taking active steps to limit the impact of a risk occurring. This group includes approaches such as diversification. This involves combining a risk with other uncorrelated risks, or at least with risk where the correlation is less than one. At the extreme, it can involve taking on risks which have a high negative correlation with the risk faced, in which case it becomes hedging rather than just risk reduction. Whilst this approach is most obviously connected to investments, it can also relate to the choice of projects on which a firm embarks. Risk reduction can also involve the creation of more robust systems and processes, in order to reduce the chance of a risk emerging, or to limit the impact of a risk.