AS ISO 31000:2018 Risk management—Guidelines
6.5.2  Selection of risk treatment options
Selecting the most appropriate risk treatment option(s) involves balancing the potential benefits derived in relation to the achievement of the objectives against costs, effort or disadvantages of implementation.
Risk treatment options are not necessarily mutually exclusive or appropriate in all circumstances.Options for treating risk may involve one or more of the following:
— avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk;
— taking or increasing the risk in order to pursue an opportunity;
— removing the risk source;
— changing the likelihood;
— changing the consequences;
— sharing the risk (e.g. through contracts, buying insurance);
— retaining the risk by informed decision.
Justification for risk treatment is broader than solely economic considerations and should take into account all of the organization’s obligations, voluntary commitments and stakeholder views. The selection of risk treatment options should be made in accordance with the organization’s objectives,risk criteria and available resources.
When selecting risk treatment options, the organization should consider the values, perceptions and potential involvement of stakeholders and the most appropriate ways to communicate and consult with them. Though equally effective, some risk treatments can be more acceptable to some stakeholders than to others.
Risk treatments, even if carefully designed and implemented might not produce the expected outcomes and could produce unintended consequences. Monitoring and review need to be an integral part of the risk treatment implementation to give assurance that the different forms of treatment become and remain effective.
Risk treatment can also introduce new risks that need to be managed.
If there are no treatment options available or if treatment options do not sufficiently modify the risk,the risk should be recorded and kept under ongoing review.
Decision makers and other stakeholders should be aware of the nature and extent of the remaining risk after risk treatment. The remaining risk should be documented and subjected to monitoring, review and, where appropriate, further treatment.