Which activity is part of the risk mitigation step in risk management?

Which activity is part of the risk mitigation step in risk management?

• A. Slogging through annual audits.
• B. Publicizing blame for risks.
• C. Eliminating all programs.
• D. Implementing controls to reduce risk.

Answer: (D)

In risk management, mitigation focuses on taking steps to lower either the chance a risk happens or the impact if it does. The best action is to implement controls designed to reduce risk—for example, security measures, policies, training, or backup systems that prevent problems or lessen their consequences. These controls actively reduce exposure and bring risk down to an acceptable level. Slogging through annual audits is part of ongoing oversight and assurance, not the preventive actions that reduce risk. Publicizing blame for risks doesn’t prevent problems and can undermine trust. Trying to eliminate all programs is extreme and impractical; mitigation aims to manage risk with practical controls rather than removing operations entirely. So, implementing controls to reduce risk is the activity that fits the mitigation step.

In risk management, mitigation focuses on taking steps to lower either the chance a risk happens or the impact if it does. The best action is to implement controls designed to reduce risk—for example, security measures, policies, training, or backup systems that prevent problems or lessen their consequences. These controls actively reduce exposure and bring risk down to an acceptable level.

Slogging through annual audits is part of ongoing oversight and assurance, not the preventive actions that reduce risk. Publicizing blame for risks doesn’t prevent problems and can undermine trust. Trying to eliminate all programs is extreme and impractical; mitigation aims to manage risk with practical controls rather than removing operations entirely.

So, implementing controls to reduce risk is the activity that fits the mitigation step.