After identifying high-risk, high-impact concerns, the risk-management team can move on to the risk mitigation phase. Risk mitigation addresses how risks will be handled. This can be done in basically four ways:

Avoid risk—Avoiding risk can seem like a simple alternative: You simply don’t perform the activity that allows the risk to be present. In reality, many activities cannot be avoided. Even when they can be, an opportunity cost might be involved so that avoiding the risk involves missing the opportunity for profit.

Reduce risk—Reducing risk is one of the most common methods of dealing with a risk. An example could be installing a firewall or implementing a new internal accounting control.