Risk reduction

Category: Risk management frameworks · Reviewed by Simon Temme, Account Executive · Last reviewed

Risk reduction

Risk reduction (also “treat” or “mitigate”) is the most common treatment in practice: changing controls, processes, behaviour or design to lower the likelihood or impact of a risk. ISO 31000 splits reduction into modifying likelihood and modifying consequences.

Modifying likelihood

• Preventive maintenance reducing equipment failure.
• Cyber controls (MFA, EDR, patching) reducing successful attacks.
• Driver training reducing motor fleet collisions.
• Pre-employment screening reducing internal fraud.

Modifying consequences

• Fire suppression systems reducing fire spread.
• Business continuity plans reducing downtime.
• Incident response retainers reducing breach cost.
• Diversification reducing single-point-of-failure exposure.

Cost-benefit and the ALARP principle

Under UK health and safety law, residual risk should be reduced so far as is reasonably practicable (SFAIRP) — a quantitative balancing of cost against risk-reduction benefit. The related concept of ALARP (“as low as reasonably practicable”) is widely used in major-hazard industries and is referenced in HSE guidance and HSE v R [2007] UKHL 27.

References

• ISO 31000:2018.
• HSE. ALARP at a glance.
• Health and Safety at Work etc Act 1974.

Cross-references

• Risk treatment
• Loss prevention
• Loss reduction

Maintained by Matt Bartlett, Director, Apex Insurance Brokers Limited. FCA FRN 724952. Companies House 07014570.