Risk Treatment Options
A risk treatment option records how the organization has decided to handle a risk. It is chosen at the control step, and one property of the chosen option decides the shape of the rest of the flow.
ISO 27001 recognizes four ways to treat a risk, and they are not four labels for the same process. Two of them involve doing work; two of them involve deciding not to.
The four options
| Code | Option | Means | Requires control selection |
|---|---|---|---|
BRI00001 | Modify | Reduce the risk by applying controls. | Yes |
BRI00002 | Retain | Accept the risk as it stands. | — |
BRI00003 | Share | Transfer it — insurance, outsourcing, a contractual term. | — |
BRI00004 | Avoid | Stop doing the thing that creates it. | — |
The one flag that drives everything
Requires control selection is the whole of the flow's first branch.
Set (Modify):
- The record must name at least one Annex A control as its treatment.
- It must open at least one measure.
- It then goes on to wait for those measures, and is verified when they close.
Clear (Retain, Share, Avoid):
- Measures and verification are both skipped.
- The residual scoring is copied from the initial pass — the residual risk of an accepted risk is its current risk.
Skipping verification as well as the wait is the part that matters. A treatment that needs no measures has nothing to verify either — parking such a risk on a verification step would ask somebody to confirm the effectiveness of measures that were deliberately not taken.
See Lifecycle.
Fields
- Code / Name — the option's identity.
- Requires control selection — the flag above.
- Description — what choosing this option commits the organization to.
- Active — inactive options are no longer offered.
Treatment option and "measure not required" are different questions
Both appear at the control step, side by side, and they are not the same switch:
| Question | Answered by |
|---|---|
| Must Annex A controls be chosen? | The treatment option's flag |
| Is anything actually going to be done? | The measure not required switch |
The switch is the control step's own answer, not a value derived from the option. It was built as a derived value first, and that was wrong twice over: the two questions are genuinely different, and a derived flag made the switch unusable because whatever the screen sent was overwritten on the way through.
Closing the control step needs one of the two answers. Either at least one measure exists, or the switch says none is needed. A risk closed with neither would move on to waiting for measures — a state with no screen from which a measure can be opened, so the record would park there permanently.
Adding your own options
The four shipped options are the standard's four, and they are ordinary rows — you may rename them, rewrite their descriptions, deactivate them or add your own.
Rewriting the descriptions is worth doing; adding a fifth option usually is not. The four are exhaustive in the standard's terms, and an organization-specific fifth ("monitor") almost always turns out to be Retain with a note. What people actually need is a description saying who has authority to choose Retain and what evidence that requires — and that belongs in the description of Retain.
Deleting an option
An option cannot be deleted while any open risk names it. Bulk delete refuses the whole selection if any row is in use.
Deactivate rather than delete: the picker loses the row while the risks that chose it stay readable.
Excel import and export
The list exports to Excel and re-loads from a filled-in template, with blank codes issued from the list's number template.