Identifying and analysing a risk is only half the job. Sooner or later, someone has to decide what actually happens next, spend money reducing it, buy insurance, walk away from the opportunity, or accept it and move on, and defend that choice if anyone asks.
This article explains what risk mitigation means, the four core strategies you can choose between, and how to turn a mitigation decision into a plan someone actually owns. By the end you will know which strategy fits a given risk, and what a workable mitigation plan needs to include.
- Risk mitigation is the action you take to reduce a risk’s likelihood or impact after it has been analysed.
- There are four core risk mitigation strategies: avoid, reduce, transfer and accept.
- The right strategy depends on cost, risk appetite and the controls already available.
- A workable mitigation plan needs an owner, a deadline and a way to check whether it worked.
- Risk mitigation reduces a risk, it rarely removes it completely.
- NIS2, DORA and ISO 27001 all require documented risk treatment, not just a list of risks.
What is risk mitigation
Risk mitigation is the set of actions an organisation takes in response to a risk that has already been identified and analysed. It is the treatment stage of the risk management process, the point where analysis turns into a decision and, ideally, into a documented action plan rather than a note in a spreadsheet.
Regulators do not stop at whether you found the risk. Frameworks such as NIS2, DORA, IMO and ISO 27001 all expect organisations to show what they actually did about a risk once it was identified, who owns the action, and by when it will be resolved or accepted.
Where risk mitigation fits
Mitigation sits after analysis and evaluation in the risk management cycle: identify the risk, analyse its likelihood and impact, evaluate it against your risk appetite, then decide how to treat it. In practice this cycle is usually run as part of a wider cybersecurity risk assessment, where mitigation actions get tracked alongside the risks they respond to, rather than as a separate exercise nobody revisits.
The four risk mitigation strategies
Most risk frameworks group mitigation responses into four categories. The names vary slightly between standards, but the logic is consistent.
| Strategy | What it means | Example |
| Avoid | Change plans so the risk no longer applies | Choosing not to expand into a market with unstable data protection law |
| Reduce | Lower the likelihood or impact with controls | Adding multi factor authentication to cut the odds of account takeover |
| Transfer | Shift some of the financial impact elsewhere | Buying cyber insurance or requiring a vendor to carry liability |
| Accept | Take no extra action, because the cost outweighs the risk | Accepting a low impact, low likelihood risk that would cost more to fix than it could ever cause |
None of these is automatically the correct choice. Accepting a risk is a valid decision when the cost of mitigation is higher than the potential loss, provided the decision is documented and reviewed, not just left unspoken.
Risk mitigation does not remove a risk. It changes the odds, and sometimes changes who is left holding them.
Building a risk mitigation plan
A mitigation decision only becomes useful once it is written down in a way someone can act on and someone else can check later. At minimum, that means naming an owner, setting a deadline, describing the residual risk that remains after the action, and setting a date to review whether it actually worked. Many teams manage this step manually in spreadsheets until the number of risks makes that unworkable, at which point dedicated risk mitigation software becomes the more reliable option.
- A named owner responsible for the action, not a team.
- A realistic deadline, tied to the risk’s priority.
- The residual risk that remains once the action is complete.
- A review date to confirm the mitigation actually worked.
Risk mitigation for vendors and supply chains
Third party risk is where mitigation gets complicated, because you cannot directly control a supplier’s environment the way you control your own. Common actions include contractual security requirements, ongoing monitoring instead of a one time check, and keeping a backup supplier for anything critical enough that a single point of failure is not acceptable. Many of these actions overlap directly with supply chain risk mitigation, since a vendor failure and a supply chain disruption are often the same event seen from two angles.
Building this into a repeatable process, rather than reacting supplier by supplier, is where most of the mitigation value comes from. Teams that follow established vendor risk management best practices tend to catch mitigation gaps earlier, before a vendor incident forces the decision.
Common mistakes in risk mitigation
A few patterns show up repeatedly in mitigation plans that do not hold up under an actual incident.
- Treating mitigation as one time, instead of revisiting it as risks change.
- Choosing accept by default to avoid the cost of proper controls.
- No named owner, so the action never actually gets done.
- Ignoring residual risk, and assuming the mitigation removed the risk entirely.
Start Your Compliance Journey Today
Frequently Asked Questions
What is risk mitigation in simple terms?
Risk mitigation is the action you take to reduce how likely a risk is to happen, or how bad it would be if it did, after the risk has already been identified and analysed.
What are the four risk mitigation strategies?
The four core strategies are avoid, reduce, transfer and accept. Avoid removes the risk entirely, reduce lowers its likelihood or impact, transfer shifts part of the financial impact elsewhere, and accept means taking no further action.
Is risk mitigation the same as risk avoidance?
No. Risk avoidance is one of four mitigation strategies, used when you change plans so a risk no longer applies. Risk mitigation is the broader term that covers avoid, reduce, transfer and accept together.
How do you know if a risk mitigation action worked?
Set a review date when the action is agreed, then check whether the risk’s likelihood or impact actually dropped compared to before the action, using the same criteria you used in the original analysis.
What is StartComply?
StartComply is a compliance platform that helps businesses manage NIS2, DORA, IMO and ISO 27001 requirements, combining risk mitigation, vendor risk management and continuous monitoring in a single system.
How does StartComply help with risk mitigation?
StartComply tracks mitigation actions against the risks they respond to, with owners, deadlines and review dates in one place, so mitigation plans stay visible instead of getting lost in a spreadsheet.
