The Four Risk Treatments: Avoid, Mitigate, Transfer, Accept

There are four treatments and no fifth. Avoid: do not take the exposure. Mitigate: reduce the chance or the impact. Transfer: move part of the loss to somebody else. Accept: keep it, on purpose, with a named person and a date. At Vindhya Commercial Bank Limited, invented, transfer on incident I8 moved 71.4 per cent of a Rs 2.1 crore loss and left Rs 0.6 crore behind.

Every one of the four is a decision about where a loss will land if it happens. Avoidance moves the landing place out of existence. Mitigation makes the landing less likely, or smaller when it comes. Transfer changes whose balance sheet it lands on. Acceptance says it lands here, that this is understood, and here is who is watching it. The four differ not in how much effort each one takes but in where the leftover sits afterwards and whose name is against it.

How a risk gets onto a register and how it gets rated are covered separately. The rating is done, the entry is written, and somebody now has to decide what happens next. The decision has exactly four possible answers, and each one leaves something different behind.

What can actually be done about a risk once it has been assessed?

Risk Treatment: the four decisions, and why the list is closed

A risk treatmentThe decision about what to do with a risk once it has been assessed and written down. is the answer to one question: given that this exposure exists and has been measured, what is going to be done about it. The answer has to be a decision somebody can take on a Tuesday afternoon, not an aspiration. And once that is insisted on, the list of available answers turns out to be short and closed.

The shape is identical in a household and the numbers are smaller, so start there. A scooter parked on the road outside carries a risk of being stolen. There are four things its owner can do. The scooter can be sold and the bus taken instead, and now there is no scooter to steal. A chain can be bought and the scooter parked under the light, and it is now harder to steal and less likely to go. The scooter can be insured, and if it goes, somebody else pays for most of a new one. Or the owner can look at the odds, decide the chain is not worth the bother, and carry on parking it where it has always been parked, knowing exactly what that means. There is no fifth thing anybody can do with that scooter, and there is no fifth thing a bank can do with an exposure either.

The list is closed because the four answers exhaust the possibilities logically rather than by convention. Either the exposure exists after the decision or it does not. The single split between existing afterwards and not existing puts avoidance on one side and everything else on the other. If the exposure still exists, either its shape was changed or it was not: changing it is mitigation. If its shape was not changed, either somebody else agreed to carry part of the loss or nobody did: somebody else carrying part of it is transfer. If nobody else is carrying it and nothing about it changed, it is being kept, and keeping it is acceptance. Four branches, no gaps, no overlaps.

People often want to add a fifth. The usual candidates are monitoring it, escalating it, and recovering the money afterwards. Monitoring is not a treatment because watching an exposure changes nothing about it; monitoring is how the risk function finds out whether the chosen treatment is still working. Escalating is not a treatment because it moves the decision to somebody else rather than making one. Recovery is the interesting case. Recovery looks more convincingly like a treatment than either of the other two and most definitely is not one, and it is taken apart below.

What does the first treatment cost, given that it works perfectly?

Risk Avoidance: not taking the exposure at all

AvoidanceNot taking the exposure at all, so there is nothing left afterwards to manage or watch. is the only treatment that ends with nothing. The position is not taken, the contract is not signed, the market is not entered, the arrangement is not adopted. Because the exposure never existed, the leftover is zero, and zero is not an approximation here. There is no control that could fail, no counterparty who could refuse to pay, and no date on which somebody has to look at it again.

Here is the instance from the case. Nirjhar Industries Limited, invented, runs a group treasury under Girish Talwalkar with cash of Rs 540 crore across 26 bank accounts, four banks and three currencies. A bank quoted the group a notional poolingAn arrangement in which balances across accounts are offset for the interest computation without any cash actually moving between them. arrangement, in which balances are offset for interest without the cash moving. The offsetting would have run across two jurisdictions and the group's own tax and legal advisers did not support it on those facts, so on its own review the group did not adopt it. Declining the arrangement is avoidance in its purest form. The arrangement was never entered into, so there is no arrangement to monitor, unwind or explain.

Notice what avoidance did not require. Avoidance required no control, no insurer, no committee paper and no named person carrying anything afterwards. The absence of all of that is exactly why avoidance looks like the strongest of the four, and it is also what hides the price.

What avoidance costs, and it is the gain rather than the effort

Avoidance gives up the gain along with the loss, and it is the only treatment that does. An exposure is not a pure liability; it is the price of admission to whatever the exposure was taken for. Refusing the exposure refuses the return that came with it. The scooter that was sold cannot be stolen, and it also cannot get anybody to work.

The case makes that price visible in rupees. The concentration Nirjhar's treasury did adopt is a physical one: a daily sweep of 18 of the 26 accounts, all of them belonging to the Indian parent and its Indian subsidiary, into a single header account. Before the sweep, those 18 accounts held gross credit balances of Rs 486 crore and gross overdrawn balances of Rs 162 crore. At the group's own contracted rates, invented, of 3.0 per cent earned on credits and 9.5 per cent paid on overdrafts, the group paid Rs 15.39 crore and earned Rs 14.58 crore, a net cost of Rs 0.81 crore a year on a group that was cash positive the whole way through. After the sweep there is one net position of Rs 324 crore earning 3.0 per cent, being Rs 9.72 crore. The swing is Rs 9.72 crore plus Rs 0.81 crore, being Rs 10.53 crore a year.

Moving cash across a border is a separate decision with its own consents, so the 8 accounts left outside belong to Nirjhar Trading FZE, a free zone establishment (FZE) and the group's overseas entity. So 18 of 26 accounts, being 69.2 per cent, sit inside the arrangement and receive their share of that Rs 10.53 crore a year, and 8 of 26, being 30.8 per cent, sit outside and receive none of it. The clean residual on the pooling arrangement the group declined is paid for by 30.8 per cent of the accounts getting nothing, and that trade is what avoidance always looks like once it is priced.

What does the second treatment change, and what does it leave behind?

Risk Mitigation: reducing the chance, or reducing the size

MitigationReducing how likely a loss is, or how large it would be if it happened, while the exposure itself stays. is where most of the work in a risk function actually goes, and it is two different things wearing one word. A control can reduce how often the bad thing happens, or it can reduce how much it costs when it does. A chain on the scooter reduces the chance. Parking it where it is visible from the window also reduces the chance. Keeping nothing valuable in the boot reduces the size. The two are not interchangeable, and confusing them is how a bank ends up spending money on a control that does not touch the thing it was bought for.

Vindhya Commercial Bank Limited has an instance of each inside one story. In month 2 a settlement instruction was sent twice and Rs 42 crore left the bank twice. The duplicate is incident I2, category 7 in the seven event categories the bank's loss log uses, and it was the largest gross loss of its year. Ten days later the same failure appeared again: a second duplicate settlement instruction, this one for Rs 68 crore. The second instruction did not go out. A four eyes checkA release that a second person has to authorise before it can happen. Taught in its own right elsewhere; named here only. caught it before release, and the bank recorded it as near missA failure that started and was stopped before it produced a loss, so it costs nothing and carries the same information as an incident. N1. Rs 68 crore against Rs 42 crore is 1.62 times the amount that got through, stopped by a control that did not exist in the path ten days earlier.

What mitigation leaves behind, and why the control working is not the end of it

Mitigation is most often misread at exactly this point. A control that catches the failure every time is not the same as a process that has stopped producing it. The four eyes check on that release worked. The check worked on a bigger amount than the one that escaped. And the process that generates duplicate settlement instructions is exactly where it was on the day incident I2 happened.

The leftover has a name. Before anything at all is done, the exposure under consideration is the inherent riskWhat was there before any treatment was applied to it.. The exposure that survives the treatment is the residual riskWhat is left after the chosen treatment has been applied to the exposure.. For mitigation the residual is not zero and it is not the original either. The residual is every future duplicate instruction the process still produces, multiplied by the chance that on some particular day the check is skipped, rushed, done by somebody who was also the maker, or simply not applied because the item took an unusual route.

The residual is why mitigation demands the most attention after the decision rather than the least. Avoidance is finished the day the exposure is declined. Transfer runs on a contract somebody else administers. Acceptance has a date in the diary. Mitigation is a promise that a thing will keep happening correctly, indefinitely, by people, and it has to be tested to stay true.

Layered defences, and why the second layer is not simply a better first one

The two events, incident I2 and near miss N1, are the clearest possible picture of an idea that belongs to James Reason, who set it out in Human Error in 1990. Reason described defences as a series of layers, each with gaps in it, and an accident as what happens when the gaps in successive layers happen to line up so that a hazard passes all the way through. The point is not that any single layer is bad; it is that no layer is complete, and the second layer exists precisely to be un-aligned with the first.

Read the case through that lens. On the day of incident I2 the instruction was produced, passed whatever checking sat at the input, and reached release with nothing standing between it and the payment system. Ten days later, an instruction with the same cause reached the release step and met a second person who had to authorise it, and stopped there. The first layer let both through. The second layer let one through and held the other. The whole architecture is in those two events: not a better single check, but a second one that fails differently from the first.

Which is why a mitigation plan that says the maker will be more careful is not a plan. A more careful maker thickens one layer. A plan that inserts a different person, at a different moment, looking at a different thing, adds a layer. Two layers with unrelated failure modes catch far more than one layer twice as thick, and that is an arithmetic statement rather than a slogan.

Does moving a loss to somebody else move all of it?

Risk Transfer: moving part of a loss onto another balance sheet

TransferMoving part of a loss onto somebody else's balance sheet, usually for a price paid in advance. is the treatment that changes whose problem the money is, and changes nothing else. The exposure is exactly where it was. The chance of the event is exactly what it was. The one change is that if the event happens, some agreed share of the cost lands somewhere other than here. Insurance does this. So do netting agreements, indemnities and a good many contract clauses. How any of those instruments works is a subject in its own right and is covered separately; what matters here is only what a transfer does to the loss.

In month 8 there was flooding at a currency chestA bank branch that holds a stock of notes and coin on behalf of the central bank as well as for its own use. branch of Vindhya Commercial Bank Limited. The flood is incident I8, category 5 in the seven event categories the bank's loss log uses, being damage to physical assets. The gross loss on incident I8 was Rs 2.1 crore. The insurance recovery was Rs 1.5 crore. The net loss booked on incident I8 was Rs 0.6 crore, and Rs 2.1 crore less Rs 1.5 crore is exactly that.

Now put the two numbers against the gross. On incident I8, Rs 1.5 crore over Rs 2.1 crore is 71.4 per cent moved, and Rs 0.6 crore over Rs 2.1 crore is 28.6 per cent retained. The two shares add to 100.0 per cent, as they must, and the second number is the one that gets forgotten. Transfer moved 71.4 per cent of that loss and not one paisa more, so almost three rupees in every ten stayed exactly where they had landed.

What transfer never moves, and what it hands over instead

Two things survive every transfer, and both of them are easy to miss because the word sounds so total.

The first is the retained share. There is essentially always one. The retained share has different names in different arrangements, but the arithmetic is the same regardless: what did not move stayed, and what stayed is a real loss with real rupees against it. The Rs 0.6 crore retained on incident I8 is not a rounding on Rs 2.1 crore; it is more than a quarter of the event.

The second is newer and quieter. Before the transfer, the bank was exposed to a flood. After the transfer, the bank is exposed to a flood for 28.6 per cent of the amount, and exposed to a counterparty for the other 71.4 per cent. The part that moved is now a claim on somebody, and a claim is worth what the person owing it can and will pay. No exposure has disappeared; part of one exposure has been swapped for part of another, and the new one may be perfectly sound, but it exists and it belongs on somebody's list.

The everyday version is familiar. A shopkeeper who insures his stock has not stopped being able to lose it. He has arranged for most of the money to come from somewhere else, on the condition that the paperwork was right, the premium was paid, and the insurer treats the event as covered. On the day of the fire he is chasing a claim, not counting cash, and the difference between those two positions is exactly what the word transfer hides.

Is keeping a risk the same as doing nothing about it?

Risk acceptance: keeping the exposure on purpose, with a name and a date

Acceptance is the treatment people are embarrassed by, and it is the one the other three fail into. A risk is accepted when avoidance costs more than the exposure is worth, when no control reduces it for less than the loss it prevents, and when nobody will take a share of it for a price the institution is willing to pay. Acceptance is not a shrug. Acceptance is a conclusion, and it is reached the same way any other conclusion is reached.

Vindhya Commercial Bank Limited has a live instance. Limit L3 is the bank's own cap on sector concentration, set at 12.0 per cent of gross advances. At the month 12 gross advances figure of Rs 58,800 crore, that cap is Rs 7,056 crore. The infrastructure and power sector stood at Rs 7,644 crore, being 13.0 per cent, so utilisation against the limit was 7,644 over 7,056, being 108.3 per cent. The excess is breach B1. Limit L3 was first crossed in month 5 at 12.2 per cent, and at month 12 the breach was still open.

The seven months in between are the point. In month 6 the board risk management committee accepted it as a temporary excess, with a remediation planA written set of actions with an end date, agreed when a breach is accepted rather than closed immediately. running to month 18, and Manjari Sondhi, head of wholesale banking, carries it. Nothing about the exposure changed on the day it was accepted, and everything about the record did. Before month 6 the bank had a limit over its cap. After month 6 the bank had a limit over its cap, a decision that it would stay over for a stated period, a person answerable for it and a month by which it ends.

The arithmetic needs one caution. The gross advances figure is locked at month 12, so the Rs 588 crore of excess, being 1.0 percentage point of Rs 58,800 crore, can only be stated there. The case holds no gross advances figure for month 5, so the month 5 reading of 12.2 per cent cannot be turned into rupees at all and every month 5 statement stays in percentage points.

How acceptance differs from doing nothing, and why the difference is entirely in the record

Put two banks side by side. Both have a sector limit that has been over its cap for seven months. Both are at 13.0 per cent against a 12.0 per cent cap. Both have the same exposure, the same borrowers and the same loss if the sector turns. From the outside, on the numbers alone, they are identical.

In the first bank a committee looked at the excess in month 6, decided that unwinding it quickly would cost more than living with it, wrote down who is answerable and set a month by which it ends. In the second bank the excess appeared, was reported, and nobody did anything, and it has been reported every month since. The first bank has accepted a risk and the second has ignored one, and the entire difference between those two sentences lives in a record rather than in the exposure.

Evidence is why acceptance is the only treatment with a document at the centre of it. Avoidance leaves evidence: the arrangement is not there. Mitigation leaves evidence: the control exists and can be tested. Transfer leaves evidence: there is a contract and a counterparty. Acceptance leaves nothing at all unless somebody writes it down. The observable state of the world after a proper acceptance and after a total failure to act is exactly the same state of the world.

Four fields carry it, and an acceptance missing any one of them is not an acceptance. The exposure being accepted, stated as a measured excess. Who is answerable, stated as a person and not a department. When it was decided. And when it ends, the one field that turns a decision into something anybody can check.

Why is chasing the money back afterwards not a fifth treatment?

This is the candidate that most deserves an answer, because it does move real rupees and it does reduce a real loss. In month 2, after Rs 42 crore had left Vindhya Commercial Bank Limited twice, the bank chased it. The bank got Rs 41.4 crore back, being 98.6 per cent of the gross, and booked a net loss on incident I2 of Rs 0.6 crore. Rs 41.4 crore is a very large amount of money brought home, and by any ordinary use of the word it was a success.

Recovery is still not a treatment, and the reason is a matter of when rather than how much. RecoveryMoney chased back after a loss has already happened, rather than anything done before it. starts after the event. Every one of the four treatments is a decision taken before the event, about an event that has not happened yet, and its whole purpose is to change what will be true if the event occurs. Recovery cannot change anything about an event that has already occurred, and it changes nothing whatsoever about the next one.

The case proves that in the sharpest possible way. Ten days after that recovery effort began, the same failure produced a second duplicate settlement instruction for Rs 68 crore. The Rs 41.4 crore that came back did not reduce the chance of the next duplicate by anything at all. The next duplicate was stopped by a second person on the release path, and a second person on the release path is mitigation. Recovery is what happens once the money has gone. Treatment is what decides how much goes.

There is one more reason to keep the two apart, and it is practical. A loss log that reports net losses is reporting gross loss minus recoveries, and that mixes a fact about the failure with a fact about how well the bank chased it afterwards. The failure and the chasing are managed by different people, respond to different fixes and belong in different columns. Ranking a loss report on the net column is what happens when the two are not kept apart.

What is left after each of the four, side by side?

The word for what is left is residual risk, and it is the honest test of every treatment decision, because it is the only thing still being carried afterwards. With the four set next to each other, the differences stop being a matter of vocabulary.

Read down the residual column and the ranking that the words suggest falls apart immediately. Avoidance leaves the least and costs the most in gain given up. Transfer leaves a share that is often larger than anybody expects. Mitigation leaves something that has to be maintained for as long as the process runs. Acceptance leaves the whole thing and is the only one that puts a person and a date against it. None of those is better than the others in the abstract, and that is what makes the choice between them the real question.

How is the choice between the four made?

Badly, if the starting point is the treatments. There is a way of thinking that lines the four up and asks which is strongest, and it always produces the same answer: avoid wherever possible, mitigate where avoidance fails, transfer what is left, and accept only as an admission of defeat. The ranking never once looks at the exposure. Feeling responsible is not the same as being right.

The choice is made by asking questions about the exposure and its cost, and the four treatments are simply what is left in hand when the questions run out. There are three of them and they are genuinely conditional, so the answer to each one closes a branch rather than scoring it.

The first question is whether the exposure can be given up without giving up something worth more. Nirjhar's treasury answered yes on the notional pool, and what it gave up was an arrangement it had not started relying on. An answer of no leads to the second.

The second is whether the chance or the size can be reduced for less than the loss the reduction prevents. A second person on the release path is cheap against Rs 42 crore going out twice, and the answer was yes. An answer of no happens whenever the only available control costs more than the expected loss, and it leads to the third question.

The third is whether anybody will carry part of the loss for a price worth paying. Somebody did on the flood at the currency chest branch, for 71.4 per cent of it. An answer of no, whether nobody offers or the price is worse than the exposure, leaves exactly one thing.

Acceptance is what the other three failed into, and understanding that is what stops it feeling like a failure to act. If the business will not give the exposure up, and no control is worth its cost, and nobody will take a share, then the honest answer is to keep it, write down who is keeping it, and set a month to look again. Any other answer at that point is a decision that has not been made.

Where does reading transfer as elimination actually cost something?

How does a lender, an analyst or a household actually use this?