Risk Treatment
The process of selecting and implementing measures to modify a risk. The four standard options are mitigate, accept, transfer, and avoid. Every identified risk should have a documented treatment decision.
Why it matters
Risk assessment without treatment is just a list of problems. Treatment is where decisions happen: which risks justify spending, which ones you consciously accept, and which ones you hand off to insurers or vendors. Auditors expect documented treatment plans with clear owners and deadlines, not just a risk register sitting in a spreadsheet.
In practice
After assessing a risk, you select a treatment strategy. Mitigation means implementing controls to reduce likelihood or impact. Acceptance means documenting why the residual risk is tolerable. Transfer shifts the risk to a third party (insurance, outsourcing). Avoidance eliminates the activity that creates the risk. In vucavoid, each risk carries a treatment plan linked to specific controls, with deadlines and assigned owners that feed into overdue tracking and your VUCA score.