XYZ Ltd. wants to expand its business operations into a volatile region of the world. The company seeks your advice about risk management strategy they can opt to mitigate the risk, and minimize or eliminate unacceptable

The risk mitigation step involves development of mitigation plans, designed to manage, eliminate, or reduce risk to an acceptable level. It would be advised to XYZ Ltd. that once they have identified and assessed the risk, the strategies to manage the risk fall into one or more of the following categories: Transfer Risk: Normally in projects, assignments or multifaceted exercises, execution is fraught with risks. Different agencies work together and these agencies take care to transfer risk in their areas to another agency which is better equipped to take care of the risk for a consideration. Here the concept of core competence comes in and whenever a particular agency, individual or a firm finds that it is dealing in an area where it does not have the core competence to deal with, it seeks the help of another agency which has the specific core competence so as to transfer its own risk to the other agency. The risk may be in the form of loss of reputation or sub quality performance and this risk is taken care of through transfer. Tolerate Risk or Risk Retention: It is retention of the risk. It is accepting the loss when it occurs. True self-insurance falls in this category. Risk retention is a viable strategy for small risks where the cost of insuring against the risk would be greater over time than the total losses sustained. All risks that are not avoided, reduced or transferred are retained by default. This includes risks that are so large or catastrophic that they either cannot be insured against or the premiums would be infeasible. War is an example since most property and risks are not insured against war, so the loss attributed by war is retained by the insured. Also, any amount of potential loss (risk) over the amount insured is retained risk. This may also be acceptable if the chance of a very large loss is small or if the cost to insure for greater coverage amount is so great it would hinder the goals of the organization too much. Reduce Risk: By far the greater number of risks will belong to this category. The purpose of treatment is not necessarily to obviate the risk, but more likely to contain the risk to an acceptable level. Internal controls are actions instigated from within the organization (although their effects may be felt outside of the organization) which are designed to contain risk to acceptable levels. Outsourcing could be an example of risk reduction if the outsourcer can demonstrate higher capability at managing or reducing risks. In this case companies outsource only some of their departmental needs. For example, a company may outsource only its software development, the manufacturing of hard goods, or customer support needs to another company, while handling the business management itself. This way, the company can concentrate more on business development without having to worry as much about the manufacturing process. Modern software development methodologies reduce risk by developing and delivering software incrementally. Earlier methodologies suffered from the fact that they only delivered software in the final phase of development; any problems encountered in initial phases meant costly rework and often jeopardized the whole project. Avoid Risk: This method results in complete elimination of exposure to loss due to a specific risk. It can be established by either avoiding to undertake the risky project or discontinuance of an activity to avoid risk. This means that no risky projects are undertaken. Alternatively, a project may be abandoned midway to mitigate the risk while handling a project. It is not performing an activity which could carry risk. An example would be not buying a property or business in order to not take on the liability that comes with it. Another would be not flying in order to not take the risk that the airplane was to be hijacked. Avoidance may seem the answer to all risks, but avoiding risks also means losing out on the potential gain that accepting (retaining) the risk may have allowed. Not entering a business to avoid the risk of loss also avoids the possibility of earning profits. Combine Risk: When the business faces two or three risks, the overall risk is reduced by combination. This strategy is suitable mainly in the areas of financial risk. Different financial instruments say, shares and debentures are taken in a single portfolio to reduce the risk. Sharing Risk: Insurance is a method of sharing risk for a consideration. For example, by paying insurance premium the company shares the risk with other companies and the insurance companies themselves share their risk by doing re-insurance. Hedging Risk: Exposure of funds to fluctuations in foreign exchange rates, prices etc., bring about financial risks resulting in losses or gains. The downside risk is often taken care by hedging.