Four responses to risk · RiskAtoms Academy

By the end you will be able to

1Choose between avoiding, reducing, transferring and accepting a risk.
2Explain how each response moves a risk on a likelihood and impact map, and what it leaves behind.
3Compare responses by their yearly cost and by the worst loss the firm still keeps.
4Explain why responses are often combined, and why transferring a risk creates new ones.

Why it matters

Once a risk is on the register, the board asks one question: what are we doing about it? There are only four basic answers. The skill is picking the right one, and knowing what each one leaves behind.

Core explanation

Avoid, reduce, transfer, accept

A firm's risk appetite (L2.3.05: Risk appetite frameworks) says how much risk it is willing to take. Each risk is then assessed by how likely it is and how much it would hurt (L2.4.03: Assessing risks: likelihood and impact). When a risk sits outside appetite, the firm must choose a risk response. There are four.

Avoid · Terminate

Stop, or never start, the activity that creates the risk, so the risk disappears.

For example: Do not launch the product; exit the market.

Reduce · Treat

Put controls in place that cut the chance of a loss, its size, or both. Also called treating or mitigating.

For example: Sprinklers, four-eyes checks, a backup data centre, limits.

Transfer · Share

Pass some or all of the cost of a loss to another party, through insurance, a hedge or a contract. Also called sharing.

For example: Insurance, a currency forward, a fixed-price contract.

Accept · Tolerate

Keep the risk knowingly, because it is within appetite or too costly to change. Also called retaining.

For example: Small, frequent losses; budget for them and monitor.

The names vary. COSO's enterprise risk management framework speaks of avoidance, reduction, sharing and acceptance; many firms remember them as the four Ts: terminate, treat, transfer, tolerate. The ideas are the same.

Where each response moves the risk. The risk before any response is the inherent risk; what is left after it is the residual risk. Avoiding removes the risk from the map. Reducing moves it towards lower likelihood, lower impact or both. Transferring usually cuts the impact to the firm but not the likelihood: insurance does not make fires rarer. Accepting leaves it where it is.

A starting point for choosing. A rough guide follows the two axes of the heat map. It is a first guess, not a rule: cost, strategy and whether a market for the risk exists all matter too.

	Low impact	High impact
High likelihood	Reduce: controls pay for themselves	Avoid: the activity is not worth it
Low likelihood	Accept: budget for it and monitor	Transfer: rare, severe losses suit insurance

Try it on five short cases. Each card moves the risk on its heat map once you choose.

ChooseWhich response fits?

0 / 0 right

A new product
A retail bank's digital team wants to let customers trade crypto-assets in its app. The board's risk appetite statement says the bank takes no exposure to crypto-assets.
Score 12
One data centre
A payments firm runs all its systems from one data centre. An outage would stop every payment, and small outages happen a few times a year.
Score 16
Dollars in six months
A Japanese exporter will receive USD 50m in six months. A stronger yen would shrink what those dollars are worth in yen, and could wipe out its profit margin.
Score 12
Office supplies
Staff at a fund manager's London office sometimes take home pens and paper. The cost is a few hundred pounds a year.
Score 4
A warehouse by the river
A food distributor's main warehouse sits on a flood plain. Floods are rare, but one would destroy stock worth far more than a year's profit.
Score 10

Score = likelihood × impact, each from 1 to 5. Green cells are within appetite (up to 6).

Every response leaves something behind. Avoiding a risk gives up the profit that came with it: risk is the price of return. Reducing costs money and never gets the risk to zero. Transferring creates new risks: counterparty risk (the insurer or bank may not pay), basis risk (the hedge may not match the exposure, L2.6.02: Hedging with forwards and futures), and the risk that a contract's wording does not cover the loss. Outsourcing moves the work but not the accountability: supervisors hold the firm responsible for what its suppliers do. Accepting is a decision, not an oversight: it should be recorded, owned by a named person and checked against appetite.

In practice most serious risks get a mix of responses. The rest of M2.6: Hedging and mitigation is about the tools: hedging with forwards, futures, options and swaps, diversification, collateral and netting, and insurance and reinsurance.

Try it

A logistics firm stores €20m of goods in one warehouse. Its board will not lose more than €5m on any single event. Switch the responses on and off. Watch two things: the cost each year, and the worst loss the firm still keeps.

Try itRespond to a warehouse fire

Chance of a fire each year2.0%

Insurance deductible€1.0m

Cost per year (axis to €1m) Actions Premium Expected loss kept

Response: Accept

Actions€0m

Insurance premium€0m

Expected loss kept€0.40m

Total per year€0.40m

Worst loss kept€20m

Breaches the board's limit of €5m on one event.

A fire destroys €20m of stock and building. Sprinklers cut the chance of a fire to a quarter. The insurer charges 1.4 × the claims it expects to pay. Illustrative figures.

Worked example

Five ways to respond to a fire

The warehouse has a 2% chance of a fire each year, which would cost €20m. Sprinklers cost €150k a year and cut the chance to 0.5%. Insurance pays everything above a €1m deductible, and the insurer charges 1.4 times the claims it expects to pay. Outsourcing storage costs €900k a year. The expected loss is the chance of a fire times the part of it the firm pays itself (M-C02: Expectation).

Cost per year and worst loss kept

Step 1 of 6

1
Accept
Expected loss: 0.02 × €20m = €0.40m a year. Cheap on average, but the worst case is the full €20m, four times the board's limit.

Sprinklers plus insurance is the cheapest plan that keeps the worst case within appetite. Doing nothing looks cheap on average, but a risk response is judged on the bad year, not the average one.

Regulatory lens

Supervisors expect a firm's responses to follow from its risk appetite: the Financial Stability Board's principles for risk appetite frameworks (2013) ask boards to set limits and act when they are breached. For insurers, Solvency II requires a risk-management system that covers reinsurance and other risk-mitigation techniques. Capital rules give credit for some transfers, such as collateral, guarantees and credit derivatives for banks, and reinsurance for insurers, but only when the transfer is legally effective. The detail comes in M4.2: Credit risk capital and M4.6: Solvency II and insurance regulation.

Sparks

SparkThe fifth response: take more

ISO 31000, the international risk management standard, lists more options than four. One of them is to take on more risk, or a new risk, in order to pursue an opportunity. COSO's 2017 framework added “pursue” for the same reason. Risk management is not only about having less risk; it is about having the right risk.

SparkInsuring yourself

Some large companies set up their own insurance company, called a captive, to insure the group. It is a formal way to accept a risk: the group keeps the losses, but sets money aside for them and can buy reinsurance for the largest ones. Bermuda, Vermont and Guernsey are well-known homes for captives.

Key takeaways

There are four basic responses to a risk: avoid, reduce, transfer and accept.
Avoiding removes the risk and the return that came with it; reducing moves it to lower likelihood or impact.
Transferring cuts the impact to the firm but adds counterparty and basis risk; outsourcing never transfers accountability.
Accepting is a recorded decision for risks within appetite, often small and frequent ones.
Judge a response by its cost and by the worst loss the firm still keeps; most serious risks get a mix.

Reaction

Check what stuck

Glossary

Risk response: What a firm decides to do about a risk it has identified: avoid, reduce, transfer or accept it.
Avoid: Stop, or never start, the activity that creates the risk, so the risk disappears.
Reduce: Put controls in place that cut the chance of a loss, its size, or both. Also called treating or mitigating.
Transfer: Pass some or all of the cost of a loss to another party, through insurance, a hedge or a contract. Also called sharing.
Accept: Keep the risk knowingly, because it is within appetite or too costly to change. Also called retaining.
Inherent risk: The level of a risk before any response or control.
Residual risk: The level of a risk that is left after the response and controls are in place.
Risk appetite: The amount and type of risk a firm is willing to take to meet its goals, set by its board.
Deductible: The part of each insured loss that the policyholder pays itself before the insurer pays.
Counterparty risk: The risk that the other party to a contract, such as an insurer or a bank, fails to pay.

Deep Dives & Origins

Deep Dives

Paul Hopkin, Fundamentals of Risk Management, 5th edition (Kogan Page, 2018), the chapters on risk response. Introductory.
ISO 31000:2018 Risk management: Guidelines, section 6.5 on risk treatment. Introductory.

Origins

COSO, Enterprise Risk Management: Integrated Framework (2004).
COSO, Enterprise Risk Management: Integrating with Strategy and Performance (2017).
International Organization for Standardization, ISO 31000:2018 Risk management: Guidelines.
HM Treasury, The Orange Book: Management of Risk, Principles and Concepts.
Financial Stability Board, Principles for an Effective Risk Appetite Framework (November 2013).
Directive 2009/138/EC (Solvency II), Article 44, Risk management.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 8-minute video will sit here, made from this page's script.