Designing Action Plans for Risk Reduction
Turning the decision to mitigate into a real plan
Deciding that a risk must be mitigated is only the starting point, and designing the action plan that actually reduces it requires specifying which concrete controls will be implemented, in what order, with what resources and under which owner, so that the risk reduction can be measured and doesn't remain a generic intention. A good plan distinguishes between actions that reduce the likelihood of the risk materializing, such as strengthening preventive controls, and actions that reduce its impact if it were to occur, such as improving response and recovery capability, since both types of action are complementary and one alone is rarely enough. In practice, the plan should also include a subsequent verification milestone confirming that the implementation actually reduced the risk to a level within the defined tolerance, because it's common to implement a control and assume the risk went down without formally measuring it again after the change.