An assessment that stops at "the risk is high" has done the easy half. The reader still has to decide what to do, and they will either invent an option in the corridor or ask you to invent one in the meeting. This lesson is how to carry a threat assessment across that gap: a small set of mitigation options, tied to the factors you actually scored, with the residual risk written in the same ink. It is not a field manual. It will not tell anyone how to attack, how to bypass a control, or how to run a protection detail. It will tell an analyst how to brief choices.
> Recommending "increase vigilance" is what you write when you have not thought of anything and hope the font will carry you.
You Do Not Own the Risk
The decision-maker owns the risk. You own the clarity of the choice. That sounds like a slogan until you watch an analyst argue a principal into a control the principal cannot fund, then act betrayed when it does not happen. Offer options. State what each option does to likelihood, impact, or time. State what risk remains. Stop. If you have a preferred option, label it as a preference and give the reason. Do not hide it inside the adjective "appropriate."
Also separate three sentences that like to collapse into one.
- The judgment. What you assess is likely to happen, to what, in what timeframe.
- The implication. What gets worse if nobody acts.
- The option. A lawful action available to this organization, with a cost and a leftover risk.
If your option requires a power the organization does not have, it is not an option. It is a wish addressed to a different agency. Name that agency and move on.
Five Moves, Applied to the Factor You Scored
Classic risk treatment is enough. The skill is attaching each move to the factor it actually changes, so you do not "mitigate" a likelihood problem with an impact measure and call it comprehensive.
- Accept. Do nothing new. Honest when the residual risk is already inside the organization's tolerance, or when every treatment costs more than the harm. Acceptance is a decision. Write the owner and the review date. Unspoken acceptance is just drift.
- Monitor. Keep the case on a watch, with indicators and a trigger to reopen. This is the right move when likelihood is low but capability is real, which is the "capable but not hostile" problem from the fundamentals lesson. Monitoring is not mitigation unless you also say what happens when the indicator fires. "We will continue to monitor" with no trigger is acceptance wearing a lanyard.
- Reduce. A control that lowers likelihood or impact using measures the organization can actually run: access rules, a backup supplier, a changed route for a public event, a staffing change, a maintenance fix, a policy that removes the asset from the exposed place. Describe the control at the level of purpose and owner. Do not publish a bypass guide, a guard order, or a set of tactics. The security manager writes the implementation. You write why this control matches this factor.
- Transfer. Insurance, a contract clause, a mutual-aid agreement, a partner who has the authority you lack. Transfer moves financial or operational burden. It rarely moves the harm to people. Say that, or someone will think the risk left the building because a premium was paid.
- Avoid. Stop the activity, move the event, decline the contract, close the exposed service for the window. Avoidance is unpopular and sometimes correct. Present it without drama when the other options do not touch the impact in time.
A good options table has four columns: the option, the factor it changes, the cost or friction, the risk that remains. Three options is plenty. Ten options is a refusal to choose what is real.
Residual Risk Is the Product
Every option leaves something behind. If you do not write the remainder, the reader will hear "solved."
Example, for the festival-weekend hospital from the prioritization lesson. You ranked a possible one-hour ambulance-bay obstruction above a vague online grievance, and you ranked a sump-pump failure as a facilities issue with a temporary pump available.
- Accept the online grievance as a watch item only. Residual risk: you will be late if the post becomes specific. Trigger to reopen: a stated time, place, or method, or any direct communication to staff.
- Reduce the bay-obstruction risk by asking event control to keep the published steward plan and a clear ambulance lane, which is a coordination measure, not a secret. Residual risk: a crowd can still spill. The duty manager needs a pre-briefed alternate bay, owned by operations, not by the analyst.
- Reduce the pump risk by staging the temporary pump before Saturday, owner facilities. Residual risk: records storage still floods if both pumps fail. Clinical floors were assessed as not exposed. If that assumption is wrong, the rank changes and avoidance — moving records — becomes the option.
- Transfer nothing in this case. There is no contract that moves an ambulance delay onto someone else. Saying so keeps insurance out of a problem it cannot touch.
That is a mitigation brief. It is specific. It is boring. Boring is what a duty manager can execute.
What Not to Recommend
A few options come up in drafts and should not survive contact with this lesson.
- Vague posture. "Increase vigilance," "enhance security," "remain alert." These have no owner and no done-state. Replace them with a control someone can schedule.
- A control that does not match the factor. More cameras do not fix a supplier who misses deliveries. Say the real option: a second supplier or a larger store on hand.
- Anything that is itself an attack, a pretext, or a way around someone else's safeguards. Not an analytical product. Not a recommendation. If the only way you can imagine reducing the risk is by harming someone, you have left the job. Hand the case to the authority that actually has a legal mandate, and document the handoff.
- A promise of zero risk. You will not deliver it, and writing it trains the reader to treat the next residual as a betrayal.
Make the Handoff Traceable
The assessment, the priority, and the option are one chain. Number them so a later review can see which judgment the control was bought to address. When the control is in place, the next prioritization scores residual risk, not the original untreated story. When the control is not in place, the evaluation is not "the analyst was wrong." It is "the option was not taken, and the risk we described is the one you still have."
Tell the owner that in one line. It keeps mitigation from becoming a blame carousel.
Exercise
Use the hospital weekend again. Ignore the online grievance. Take only the missed pharmacy deliveries: four days of controlled-drug cover, next delivery booked Friday, no second supplier.
Write a half-page options note.
- One accept, one reduce, and one avoid. Monitoring may be part of accept, but only if you include a trigger.
- For each, name the factor it changes and the residual risk in a sentence a nurse manager would recognize.
- Name the owner. "The hospital" is not an owner.
- Strike any sentence that tells someone how to defeat a lock, a cupboard, or a delivery process. If the risk is theft, your option is still about cover and resupply, not about how a theft would be done.
End with the preference you would actually state, labelled as a preference, and the fact that would make you withdraw it.
