Risk avoidance vs Risk mitigation

Why they differ

Avoidance stops the activity; mitigation keeps it and adds controls to make it safer.

Risk management

Removing a risk entirely by not doing, or no longer doing, the activity that creates it.

Formal

The risk treatment option in which the organisation decides not to start, or to stop, the activity, system or data handling that gives rise to the risk, so the risk no longer exists.

In plain English

Like selling the trampoline because the children keep getting hurt - no more jumping, but also no more broken arms.

In practice

A fitness chain finds an old database of former members that nobody uses; rather than protect it, it deletes it - data it no longer holds cannot leak.

Why it matters

It is the only option that removes a risk completely, but it also gives up whatever value the activity had, so it suits risks that bring the business little gain.

Risk mitigation

Risk management

Lowering a risk by adding controls that make it less likely to happen or less harmful if it does.

Formal

The risk treatment option in which controls are chosen and put in place to reduce the likelihood, the impact, or both, until the remaining risk falls within the risk appetite.

In plain English

Like putting a rubber mat in the shower and a grab bar by the bath - you still wash, but a fall is less likely and less bad if it happens.

In practice

After fraud attempts, an unemployment fund requires a second case officer to approve any change of a member's bank account and has staff call the member back first; the risk moves from high to medium.

Why it matters

It is by far the most used option and the one most security work is about, but a risk is never removed this way - some always remains.

Shared connections

Risk treatment