Risk treatment (リスク対応) is the activity of choosing how to deal with each evaluated risk, drawing up a concrete plan of measures and carrying it out.
Risk identification
Risk analysis
Risk evaluation
Risk treatment
Treatment: choose how to deal with the risk, plan the measures and carry them out.
4 / 4
The three stages of identification, analysis and evaluation are together called risk assessment, and risk treatment follows from its results. One scheme sorts treatments into avoidance, transfer, reduction and retention, while another puts sharing in place of transfer: avoidance, sharing, reduction and retention. Of these, risk reduction keeps the activity going but adds measures to lower the likelihood of the risk or the damage when it occurs.
AnalogyIt is like the point after a health checkup, once the numbers are in, when you and your doctor decide whether to get treatment, take out insurance or wait and see.
How to rememberAssessment is where you measure; treatment is where you act. Remember the order: you cannot act before you measure.
Exam points
ExamAmong the four processes of identification, analysis, evaluation and treatment, risk treatment (リスク対応) comes after evaluation is complete. Risk assessment (リスクアセスメント) covers the three stages up to evaluation and does not include treatment.
ExamChoosing a treatment and planning measures are part of risk treatment. Estimating the size of a risk and judging whether action is needed belong to the analysis and evaluation that come before it.
ExamClassifications such as avoidance, transfer, reduction and retention distinguish the kinds of treatment taken for each risk. They are not implementation steps carried out in a fixed order.
Risk avoidance (リスク回避) is a treatment that stops the activity causing the risk, leaving no room for the risk to arise.
It removes the source of the risk by cancelling a plan before it starts or pulling out of an existing business. The risk disappears, but so does the profit the activity would have brought. For that reason it is considered when the potential damage is too large to accept by any other means.
AnalogyIt is like calling off a day's climb altogether because heavy snow is forecast. If you never go up the mountain, you cannot get lost on it.
Exam points
ExamKeeping the activity going while adding measures to lower the likelihood or damage is not risk avoidance (リスク回避) but risk reduction (リスク低減). The dividing line is whether the activity stops.
Mix-upRisk avoidance gives up the risk together with the activity that causes it, whereas risk retention (リスク保有) keeps both the activity and the risk and accepts them.
Risk retention (リスク保有) is a treatment that takes no further measures against an evaluated risk and simply keeps it; it is also called risk acceptance (リスク受容).
It suits risks that are unlikely to occur or would cause little damage if they did. It is also considered when the cost of countermeasures would exceed the expected loss. Unlike leaving a risk alone without noticing it, it is a decision made as the result of evaluation.
AnalogyIt is like deciding not to bother writing your name on a cheap plastic umbrella, since you can just buy another if you lose it.
How to remember“Retention” means holding on, and “acceptance” means taking it in. Both point toward not letting go, so remember them as two names for the same treatment.
Exam points
ExamRisk acceptance (リスク受容) refers to the same treatment as risk retention (リスク保有). Knowing the risk exists, the company takes no further measures and decides in advance to bear any damage itself.
Risk transfer (リスク移転) is a treatment that uses insurance or contracts to shift the burden of losses to a third party when the risk materializes.
The typical example is buying insurance, where the insurer covers the financial burden when damage occurs. The likelihood of the risk itself does not change; only who carries the burden when it occurs does.
AnalogyIt is like insuring your belongings for a move so that the insurer pays if something breaks. Your things are no less fragile than before.
How to rememberThink of rewriting the address on the bill for the damage from your company to another one: the burden is transferred.
Exam points
ExamIn the scheme that includes transfer, buying insurance counts as risk transfer (リスク移転), because it shifts the financial burden of an accident to the insurer.
ExamInsurance does not change how likely an accident is or how much damage it causes, only who pays for the damage, so buying insurance is neither risk avoidance (リスク回避) nor risk reduction (リスク低減).
Risk sharing (リスク共有) is a treatment that splits a risk with other organizations by agreement, so that the company does not bear all the damage alone when the risk materializes.
Buying insurance and signing contracts with business partners that divide costs and responsibilities both fall into this category. The risk is no less likely to occur, but the company's share of the damage becomes smaller.
AnalogyIt is like a few friends renting a holiday house together and agreeing in advance on how to split any repair bills.
Exam points
ExamWhen risk sharing (リスク共有) takes the place of risk transfer (リスク移転) in a four-way classification, buying insurance against damage is classed as sharing.
Mix-upRisk sharing is a broad concept that also covers risk transfer, which shifts the burden to others; its core is splitting risk with other organizations by agreement.
Risk diversification (リスク分散) is the idea of splitting assets, sites and the like into several parts so that a single accident or disaster cannot spread damage across everything at once.
For example, if work is spread over several servers instead of all running on one, a single server going down affects only part of the business. What sets it apart is that it narrows how much damage is taken at once rather than eliminating the risk itself.
AnalogyIt is like keeping your wallet and your cards in different pockets, so losing one does not mean losing everything.
How to rememberThe saying “don't put all your eggs in one basket” fits it exactly.
Exam points
ExamRisk diversification (リスク分散), which limits damage by splitting sites or data within the company, is a reduction-type measure, not risk sharing (リスク共有). Spreading risk to another organization by agreement is what counts as sharing.
Risk treatment is the stage after risk identification, analysis and evaluation (risk assessment) in which a way of handling each risk is chosen, planned and carried out.
Risk retention (acceptance) is not neglect but a decision, made after evaluation, that the company will bear the damage itself.
Which treatment to choose is decided by weighing the size of the expected loss against the cost of the measures.