One of the steps in the risk management process is to establish the risk treatment required. The purpose of risk treatment is to:

The primary purpose of risk treatment is to modify unacceptable risks to a level that is tolerable to the organization, in line with its risk appetite. This is achieved by selecting and implementing appropriate controls and measures. The most common form of risk treatment is mitigation, which involves actions specifically designed to reduce the likelihood of a disruptive incident occurring or to lessen the negative consequences (impact) if it does happen. While other treatment options exist (e.g., accept, transfer, avoid), mitigation is the core activity described in the correct option.

A. This describes the assignment of a risk owner, a governance step to ensure accountability, not the purpose of the treatment action itself.

B. This describes risk analysis, the process of evaluating and scoring risks, which is performed before the risk treatment stage.

D. This describes risk monitoring and communication, which are ongoing activities to review the effectiveness of treatments and inform stakeholders.

1. ISO 31000:2018

Risk management — Guidelines. Clause 6.5.1

"General

" states: "The purpose of risk treatment is to select and implement options for addressing risk." Clause 6.5.2

"Selection of risk treatment options

" lists methods for modifying risk

including "changing the likelihood" and "changing the consequences

" which are the fundamental components of mitigation.

2. The Business Continuity Institute (BCI)

Good Practice Guidelines (GPG)

2018 Edition. Professional Practice 2 (PP2): Analysis

Section 5.6

"Risk Treatment

" explains that after risks are evaluated

"the organization can decide on the most appropriate way to treat the risk." It outlines options

with a primary focus on mitigation through controls that reduce likelihood or impact.

3. Hiles

A. (2011). The Definitive Handbook of Business Continuity Management. John Wiley & Sons. Chapter 11

"Risk Assessment and Control

" details that the objective of risk treatment is to apply controls to reduce the identified risks to an acceptable level

primarily by addressing the probability (likelihood) and/or the business impact of a threat. (Referenced as a foundational academic text in the BCI domain).