Risk optimization

Over the last few chapters, we learned that all risks are not the same and different risks demand different risk responses. That said, the goal of all risk responses is to optimize the risk as much as possible. In some cases, the risk responses are immediately apparent; however, other risks require detailed analysis to provide a response that is best aligned with the organization’s goals and business objectives. An organization can choose a risk response based on the following factors:

• Risk category (critical/high/medium/low)
• The cost of associated risks
• The cost of risk response, such as the cost of implementing controls or insurance premium
• The availability of controls
• Available skillsets
• The complexity of implementing controls
• Resources and budgeting
• The alignment of the risk response with organizational strategy
• Compatibility with current controls
• Contractual requirements
• Legal and regulatory requirements
...