Risk Mitigation: Strategies, Controls and Treatment Plans

What are the risk mitigation strategies?

AS ISO 31000:2018 sets out the options for treating a risk: avoiding it, taking or increasing it to pursue an opportunity, removing its source, changing its likelihood, changing its consequences, sharing it, and retaining it by an informed decision.¹ Mitigation in the everyday sense covers the middle of that list. The table shows the options that apply to most security and resilience risks.

Options are usually combined. A site that holds valuable stock might reduce the likelihood of theft with access control and lighting, reduce the consequences with insurance and stock limits, and accept a small remaining risk.

How security controls work in layers

For security risks, controls work best in layers, so that the failure of one does not leave the risk unmanaged. A common way to think about the layers is:

• Deter: make the target look hard or unattractive, for example with visible lighting, signage and good maintenance.
• Detect: know when something is wrong, through alarms, CCTV, staff awareness and reporting.
• Delay: slow an intruder down long enough for a response, with fences, doors, locks and secure rooms.
• Respond: make sure someone can act in time, through guards, police, procedures and duress alarms.
• Recover: get back to normal operations, through business continuity plans, backups and insurance.

Layering also means using different kinds of control together: physical measures, technology, procedures and people. A camera nobody watches, or a lock with an unmanaged key register, mitigates very little.

Where work health and safety fits

Some security risks are also work health and safety risks, such as aggression towards staff, lone work and occupational violence. For these, Australian WHS duties expect controls to be chosen using the hierarchy of controls: eliminate the risk where possible, then minimise it through substitution, isolation and engineering controls, then administrative controls, and finally personal protective equipment.³ Higher-order controls protect people more reliably than procedures alone.

What goes in a risk mitigation plan?

A treatment or mitigation plan turns the decision into actions that can be funded, tracked and checked. For each risk it should record:

1. The controls chosen, and why they were chosen over the alternatives.
2. Who is responsible for putting them in place, and who owns the risk.
3. The actions, resources and budget required.
4. When each action will be done.
5. How success will be measured, including key risk indicators where they are useful.
6. The expected residual risk, and who accepted it.

For Australian Government entities, the PSPF expects security plans to reflect the entity’s agreed tolerance to security risks, so the residual risk should be measured against that tolerance.²

Common mistakes in risk mitigation

• Buying technology before the risk has been assessed.
• Relying on a single control, so one failure leaves nothing in place.
• Controls that are installed but never maintained, tested or monitored.
• No owner for the residual risk, so nobody decides whether it is acceptable.
• Spending more on a control than the risk could ever cost, or too little on a serious risk.

How Agilient helps

Agilient turns security risk assessments into practical, costed mitigation plans that boards and executives can fund and track. Recommendations are proportionate to the risk and independent of any product, because Agilient does not sell or install security equipment. See the security risk management framework guide for how mitigation fits the wider process.