Risk mitigation is a choice between reducing exposure, consequence or uncertainty

Choose the mechanism of risk reduction

Risk mitigation is not one generic control. An action can reduce exposure, lower consequence, shorten duration or improve knowledge. Avoidance, prevention, detection, response, transfer and acceptance create different economics and residual risk. Comparing them explicitly prevents activity from being mistaken for protection.

The starting point is a causal pathway and objective. Diversification reduces concentration; engineering controls reduce failure probability; buffers reduce immediate consequence; insurance transfers defined financial loss; testing reduces uncertainty. No measure should receive credit for a mechanism it does not affect.

Options are compared on risk reduction, cost, lead time, flexibility and new dependencies. Controls can create second-order exposure: outsourcing transfers execution but may concentrate vendors; inventory protects continuity but raises obsolescence; automation reduces error while adding cyber reliance.

Residual risk needs an owner and acceptance against appetite. Assumptions and control performance are monitored through leading evidence. Temporary measures have expiry and transition, while layered defenses avoid dependence on one barrier.

Portfolio review prioritizes mitigation where marginal reduction is greatest and recognizes diminishing returns. The goal is a deliberate combination that changes the relevant pathway, preserves strategic options and makes the uncertainty retained by the enterprise explicit.