Treating and reviewing business risks

Risk treatment is about making plans for the unacceptable risks to your business. You treat the risks to:

  • reduce or remove the likelihood and impact of negative events
  • increase the likelihood and impact of positive events.

You should treat the most urgent risks first.

Risk treatment plan

A risk treatment plan should outline your risk treatment strategies for each risk. Well organised paperwork can help you to treat future risks more quickly.

A good risk treatment plan should have information on:

  • type and level of risk to be treated
  • suggested strategies to treat each risk
  • timeframes for each strategy
  • who's responsible for specific parts of the plan
  • resources required such as money, staff and external help
  • future action such as regular checking and updating of risks, if needed.

Strategies you can use to treat the unacceptable risks in your business include:

Share the risk

You can transfer or share some of your business risks, for example by:

  • buying insurance
  • entering into a partnership
  • outsourcing tasks (such as getting an IT consultant to manage your IT needs).

Keep in mind that risks don't completely transfer to the other party and there may still be impacts on your business. For example, you could enter into an insurance contract for complete coverage. However, you must still pay an excess amount and there will be time lost before you can get back to business as usual.

Reduce the risk

You can reduce risk by:

  • reducing the chance of negative events or increasing the chance of opportunities for your business.

    For example, you could get an IT solutions company to regularly backup your business data in more than one place. This would reduce the chance of negative events such as losing your clients’ data. This would also increase the chance of getting more customers because of the extra security.

  • reducing the size of expected losses or increasing the expected gains from opportunities.

    For example, you could plan for emergencies and other unexpected events to reduce business losses. If you have a unique product design, you could make sure you own the intellectual property (IP) to increase expected gains (such as sell or licence your IP).

Avoid the risk

If you can’t reduce a risk to an acceptable level, you may decide to avoid the activity that creates the risk. This should be your last option, because avoiding the activity could mean missed opportunities for your business. Usually, improving processes or increasing staff can result in reduced risks for an activity.

Example: John's story

John runs a suburban bakery. He wants to introduce new menu items to increase revenue. Before deciding on the menu change, he does a thorough risk assessment and identifies two risks. He sees that  some new menu items will contain ingredients with a short shelf life  but the current supplier doesn’t stock the ingredients throughout the year.

John is concerned about the risk of food poisoning due to short shelf life. He's also worried about creating  unhappy customers due to the lack of new menu items.

After John discusses these concerns  with his staff and suppliers, he decides not to add the new items to the menu yet and looks for other menu items he can add instead.

Check the risk regularly

Risks to your business are likely to change as your business, industry or customer base changes.

To allow for this, make sure your risk management plan includes steps to:

  • regularly check your existing risks
  • update the plan when needed
  • regularly check for new risks.

What to do next



Thanks for your feedback. If you have any ideas on how we can improve, we'd love to hear them.

Please provide your comments in the feedback form.

You might also be interested in