Skip to main content
Governance Authority
Category: Enterprise Risk Management

Risk Reduction

Also known as: Risk Mitigation, Risk Treatment (reduction approach)
Simply put

Risk reduction is the process of taking deliberate steps to lower either how likely a risk is to occur or how much harm it could cause, bringing it down to a level the organization considers acceptable. It is one of several ways organizations can respond to a risk, and it typically relies on putting controls, processes, and other measures in place. The goal is not always to eliminate a risk entirely but to manage it so that any remaining exposure is tolerable.

Formal definition

Risk reduction is a risk treatment approach involving the systematic implementation of controls, processes, and measures intended to decrease the probability (likelihood) and/or impact of identified risks to a level consistent with the organization's acceptance criteria. It is generally one of several recognized risk treatment options and characteristically leaves a degree of residual risk after treatment, which is then evaluated against the organization's risk appetite and tolerance. In practice, the design and operation of these measures is typically owned by management as part of ongoing risk management activities; the specific methods, standards, and acceptable thresholds vary by jurisdiction, sector, and applicable framework. This entry is educational and not legal, audit, or compliance advice.

Why it matters

Risk reduction is central to how organizations translate risk awareness into action. Identifying and assessing risks has limited value unless an organization can then decide what to do about them, and reduction is often the most practical response when a risk cannot be eliminated, transferred, or simply accepted. By deliberately lowering either the likelihood of a risk materializing or the harm it would cause, an organization narrows the gap between its inherent exposure and the residual exposure it is prepared to live with. This connects risk reduction directly to an organization's stated risk appetite and tolerance, since the point of the exercise is to bring exposure within levels the organization considers acceptable.

Risk reduction also matters because it is rarely a one-time event. Controls and measures degrade, business conditions change, and new risks emerge, so reduction is generally an ongoing activity rather than a finished state. The concept extends across disciplines: in the disaster context, for example, frameworks such as those maintained by the UN Office for Disaster Risk Reduction (UNDRR) frame reduction as preventing new risk, reducing existing risk, and managing the residual risk that remains, underscoring that even after treatment some exposure typically persists and must continue to be managed.

Because reduction characteristically leaves residual risk, its effectiveness depends on honest evaluation of what remains after controls are applied. Overstating the effect of a control, or assuming a control designed on paper is operating effectively in practice, can leave an organization believing it is protected when it is not. The methods, standards, and acceptable thresholds vary by jurisdiction, sector, and applicable framework, so what counts as adequate reduction in one setting may fall short in another.

Who it's relevant to

Management and Risk Owners
Management typically owns the design and operation of the controls and measures used to reduce risk. This includes selecting appropriate treatments, implementing them within business processes, and monitoring whether they continue to bring exposure within acceptable levels as conditions change.
Chief Risk Officers and Risk Functions
Risk functions help frame reduction decisions in relation to the organization's risk appetite and tolerance, support consistent assessment of likelihood and impact, and evaluate residual risk after treatment. They generally coordinate the broader treatment approach rather than owning day-to-day operation of individual controls.
Boards and Risk Committees
Boards and their committees typically exercise oversight of the organization's approach to risk, including whether the level of residual risk left after reduction is consistent with the risk appetite they have set. Their role is generally one of oversight and challenge rather than operational management of specific controls.
Internal Audit and Assurance Functions
Assurance functions may provide independent evaluation of whether risk reduction measures are both well designed and operating effectively. This helps confirm that residual risk is genuinely at the level management believes, and that reliance placed on controls is warranted.
Compliance Officers
Where risks arise from legal or regulatory obligations, compliance officers may be involved in reduction measures such as controls, monitoring, and processes intended to lower the likelihood or impact of non-compliance. The specific requirements and acceptable thresholds vary by jurisdiction, sector, and entity type.

Inside Risk Reduction

Risk Treatment Option
Risk reduction (also described as risk mitigation) is one of several recognized risk treatment options, sitting alongside avoiding, transferring or sharing, and accepting a risk. Under frameworks such as ISO 31000, it refers to actions taken to lower a risk's likelihood, impact, or both, rather than to eliminate the risk entirely.
Preventive and Detective Controls
Reduction is typically achieved by designing and operating controls. Preventive controls aim to reduce the likelihood of an adverse event, while detective controls aim to identify events that occur so their impact can be limited. Reduction commonly relies on a combination of both.
Effect on Inherent Versus Residual Risk
Risk reduction generally operates on inherent risk (the exposure before controls) to arrive at a lower residual risk (the exposure remaining after controls operate as intended). The distinction matters because the amount of reduction depends on control design and operating effectiveness, not merely on the existence of a control.
Alignment with Risk Appetite and Tolerance
Reduction efforts are typically calibrated to bring residual risk within the organization's stated risk appetite and specific risk tolerances. The goal is generally not to reduce risk to zero, which is often impractical or uneconomic, but to a level management and the board judge acceptable.
Ownership and Accountability
Under a three-lines model, management (first line) generally owns and operates the controls that reduce risk, the risk and compliance functions (second line) provide oversight, challenge, and monitoring of those efforts, and internal audit (third line) provides independent assurance over their design and effectiveness. The board and its committees oversee the overall approach rather than executing it.
Cost-Benefit Consideration
Selecting a reduction measure typically involves weighing the cost and effort of additional controls against the expected decrease in likelihood or impact, since further reduction often yields diminishing returns.

Common questions

Answers to the questions practitioners most commonly ask about Risk Reduction.

Is risk reduction the same as eliminating risk entirely?
No. Risk reduction (sometimes called risk mitigation) generally aims to lower a risk's likelihood, impact, or both to a level within the organization's risk appetite, not to remove the risk completely. Eliminating a risk altogether is typically associated with risk avoidance, which involves ceasing or not undertaking the activity that gives rise to the exposure. After reduction measures are applied, some residual risk usually remains, and that residual level is what the board and management ultimately accept, transfer, or subject to further treatment. Whether a given residual level is acceptable depends on the organization's stated appetite and tolerances and is a matter of judgment rather than a fixed rule.
Does implementing a control automatically mean a risk has been reduced?
Not necessarily. Designing and implementing a control addresses control design, but a risk is only reduced in practice to the extent the control also operates effectively over time. A well-designed control that is not consistently performed, is overridden, or is undermined by changing conditions may leave residual risk higher than intended. For this reason, assurance functions typically distinguish between evaluating whether a control is suitably designed and testing whether it is operating effectively. Claiming risk reduction generally requires evidence on both points, not merely the existence of a control on paper.
Who is accountable for deciding which risks to reduce and how?
Accountability structures vary by organization and jurisdiction, but under commonly applied governance models management typically owns the identification, treatment, and day-to-day operation of controls that reduce risk, operating within an appetite and tolerances that the board sets or approves. The board and its relevant committees (such as an audit or risk committee) generally exercise oversight, challenging whether treatment decisions are consistent with appetite, rather than performing the mitigation activities themselves. Assurance functions such as internal audit typically provide independent evaluation of whether risk reduction efforts are designed and operating as intended. The precise allocation depends on the entity's structure, sector, and applicable requirements.
How can an organization tell whether a risk reduction effort has actually worked?
Organizations generally assess effectiveness by comparing the residual risk after treatment against the target level implied by their risk appetite and tolerances, considering both likelihood and impact separately. This often involves evidence that controls are operating effectively, not just designed, drawn from monitoring, key risk or control indicators, testing, and incident data. Because measurement depends on the quality of underlying data and assumptions, conclusions are typically expressed with appropriate qualification. This entry is educational and not a substitute for professional risk, audit, or compliance judgment applied to specific facts.
How does risk reduction fit alongside other risk treatment options?
Risk reduction is generally one of several treatment options considered within a broader risk management process, commonly discussed alongside avoiding the risk, transferring or sharing it (for example, through insurance or contractual arrangements), and accepting it. Under frameworks such as ISO 31000 or COSO's enterprise risk management materials, these options are typically weighed against the risk's assessed level, the cost and feasibility of treatment, and the organization's appetite. In practice, a single risk may be addressed through a combination of reduction and other treatments. The appropriate mix is a matter of judgment and varies by organization and circumstance.
What role does documentation play in supporting risk reduction decisions?
Documentation typically supports risk reduction by recording the assessed inherent risk, the treatments selected, the rationale for those choices relative to appetite and tolerances, and the resulting residual risk. Clear records generally help demonstrate that decisions were considered and approved at an appropriate level, support monitoring over time, and provide a basis for assurance functions to evaluate design and operating effectiveness. The nature and formality of documentation expected can vary by jurisdiction, sector, entity type, and any applicable requirements or frameworks, so organizations often calibrate their approach to their own regulatory and governance context.

Common misconceptions

Risk reduction means eliminating the risk.
Reduction generally lowers likelihood or impact to leave a residual risk; it does not remove the exposure entirely. Eliminating a risk altogether is closer to risk avoidance, which is a distinct treatment option, and even that is not always achievable.
Having a control in place proves the risk has been reduced.
The existence of a control speaks to control design; actual reduction depends on the control operating effectively over time. A well-designed control that does not operate as intended may leave residual risk substantially higher than expected.
Risk reduction is the risk function's job to carry out.
In many organizations following a three-lines model, management owns and operates the mitigating controls, while the risk and compliance functions provide oversight and challenge and internal audit provides independent assurance. Attributing the operational task to the second or third line blurs accountability.

Best practices

Define target residual risk levels against a documented risk appetite and specific tolerances before selecting mitigation measures, so reduction efforts have a clear stopping point rather than defaulting to reducing risk as far as possible.
Assess both control design and operating effectiveness, and avoid treating the mere presence of a control as evidence that risk has actually been reduced.
Combine preventive controls (to lower likelihood) with detective controls (to limit impact) where a single measure is unlikely to bring residual risk within tolerance.
Clarify ownership by ensuring management operates the mitigating controls while the risk and compliance functions provide oversight and internal audit provides independent assurance, keeping the lines of accountability distinct.
Weigh the cost and effort of additional controls against the expected reduction in likelihood or impact, recognizing that further mitigation often produces diminishing returns.
Reassess residual risk periodically and after significant change, since a reduction that was adequate under earlier conditions may no longer keep exposure within appetite.