Guide

What is risk mitigation? Definition, steps and strategies

Risk mitigation is the action you take to lower the likelihood or the impact of a risk, so it sits within the level of risk you are willing to accept. You do it with controls that prevent, detect or correct. It is one step in risk management, which also covers identifying, assessing and monitoring risk.

By Matt Collis·Updated 21 October 2026·Reviewed 21 October 2026·Version 3·5 min read

This guide is for business owners and compliance staff who want to put risk mitigation into practice. It uses the terms of ISO 31000, the international risk management standard, and the Australian Government’s risk guidance.

What is risk mitigation?

Risk mitigation is any action that lowers the likelihood of a risk, its consequences, or both. The aim is not zero risk. It is to bring each risk within the level your organisation has agreed to accept.

Risk itself has a precise meaning. The Department of Finance (Finance), in its guide to the Commonwealth Risk Management Policy, defines it as the effect of uncertainty on objectives. That effect can be positive or negative, so a risk can be an opportunity as well as a threat.

Mitigation works through controls. Finance defines a control as any process, policy, device, practice or other action that modifies the likelihood or consequence of a risk.

How is risk mitigation different from risk management?

Risk management is the whole system. Finance describes it as the coordinated activities to direct and control an organisation with regard to risk.

Mitigation is the treatment step inside that system. You identify and assess a risk first, then decide whether it needs treatment, then check that the treatment works.

Two settings guide that decision. Risk appetite is the amount and type of risk you are willing to accept to achieve your objectives. Risk tolerance is the level of risk taking that is acceptable for one specific objective.

What remains after your controls is residual risk. The Australian Transaction Reports and Analysis Centre (AUSTRAC) uses the same idea for money laundering: the risk that remains after you have put your policies in place.

What are the four ways to respond to a risk?

Four ways to respond to a risk

Response	What you do	Example	Watch for
Avoid	Stop or decline the activity that creates the risk	Not offering a service whose risk you cannot control	You also give up whatever the activity would have earned
Reduce	Add controls that lower the likelihood or the consequence	Approvals and separation of duties for payments, or a disaster recovery plan	Each control needs an owner and regular testing
Transfer	Move some financial cost to a third party, by insurance or contract	An insurance policy, or an indemnity in a supplier contract	Legal obligations stay with you. An AML/CTF reporting entity that outsources checks stays liable for breaches
Accept	Keep the risk by an informed decision	A low-rated risk where a control would cost more than the harm it prevents	Record the reason, and keep monitoring and reviewing the risk

Sources: Department of Finance, RMG 211 glossary of terms; Department of Finance, RMG 211 Element 5: Control effectiveness; AUSTRAC, Overview of reliance on customer identification by a third party Reviewed 21 Oct 2026

Reducing a risk is mitigation in the narrow sense. Avoiding, transferring and accepting decide whether you carry the risk at all, and who carries its cost.

Risk guides usually group the responses into four, and you can combine them. A business might reduce a payment fraud risk with approvals, then insure the loss that is left.

Accepting a risk is a decision, not a default. Finance describes risk acceptance as an informed decision to take a particular risk, and accepted risks stay subject to monitoring and review.

For how each strategy applies to money laundering risk, with AUSTRAC’s own examples, see risk mitigation strategies.

What are the steps in the risk mitigation process?

The risk management process, step by step

Mitigation is step 5, the treatment

Step 1
Set the context

Agree your objectives, scope and risk criteria.
Step 2
Identify risks

Find and describe risk sources, events, causes and consequences.
Step 3
Analyse

Work out the level of each risk, usually from likelihood and consequence.
Step 4
Evaluate

Compare each level with your risk criteria to decide what needs treatment.
Step 5
Treat

Avoid, reduce, transfer or accept, with an owner for each control.
Monitor and review

Test whether controls work, track key risk indicators and reassess when things change.

Communicate and keep records at every step.

Sources: ISO, ISO 31000:2018 Risk management: Guidelines; Department of Finance, RMG 211 glossary of terms Reviewed 21 Oct 2026

You cannot choose a sensible control for a risk you have not analysed, and a control nobody checks may have stopped working. Monitoring feeds back into the earlier steps when things change.

ISO 31000 sets out a process for identifying, analysing, evaluating, treating, monitoring and communicating risks. Mitigation is the treatment step.

Each step feeds the next. Your risk criteria from step 1 decide what counts as acceptable in step 4.

Keep the results in a risk register, a record of the risks you have identified. Give each risk an owner with the accountability and authority to manage it and its treatments.

What controls reduce a risk?

Finance groups controls into three types. Most risks need more than one, and a single control can do more than one job.

Preventive: lower the likelihood, such as approvals, delegations, separation of duties, security tools and training.
Detective: find failures, such as reconciliations, exception reports and investigations.
Corrective: limit the consequence or fix a failure, such as business continuity, crisis management and disaster recovery plans.

Controls should be proportionate to the risk. Each needs an owner who reports on whether it is in place, tested and effective.

Test a control more often when the risk is severe or your appetite is low. Test it again after a change, such as a new IT system or new staff.

How do you decide which risks to treat first?

Rate each risk by its likelihood and its consequence, then compare that level with your risk criteria. Finance calls this comparison risk evaluation.

Risks outside your tolerance come first, especially where the controls in place are not working. Those are the risks that need further treatment.

Scale the method to your business. For money laundering risk, AUSTRAC suggests likelihood and impact for medium complexity businesses, and impact alone for smaller, low complexity ones.

Rate the inherent risk first, before any controls. Then rate it again after treatment, so you can show that the residual risk has fallen.

Is risk mitigation a legal requirement?

For many regulated businesses, yes. Australia’s AML/CTF Act requires every reporting entity to assess its ML/TF risks and then to manage them.

Key point

Under s 26F of Australia’s AML/CTF Act, a reporting entity’s policies must appropriately manage and mitigate the ML/TF risks of its designated services.

Those policies must suit the nature, size and complexity of your business. Since 1 July 2026, the regime also covers accountants, lawyers, conveyancers and real estate agents.

Starting to serve a customer without compliant policies is a civil penalty provision. Under s 175 of Australia’s AML/CTF Act, a company faces up to 100,000 penalty units (A$36.4 million) per contravention. An individual faces up to 20,000 units (A$7.28 million).

Your ML/TF risk assessment comes first, and mitigation builds on it. For what a breach can cost, see AML non-compliance penalties.

Registered tax and business activity statement (BAS) agents have a parallel duty. The Tax Practitioners Board (TPB) requires a quality management system that gives you reasonable confidence you comply with the Code of Professional Conduct.

Frequently asked questions

Is risk mitigation the same as risk avoidance?

No. Avoidance removes the risk by stopping the activity that creates it. Mitigation keeps the activity and lowers the likelihood or consequence of the risk with controls.

What is residual risk?

The risk that remains after your controls are in place. If it still sits outside your appetite, treat it further or have someone with authority decide to accept it.

Can you get certified in ISO 31000?

No. ISO says ISO 31000 gives good practice guidelines and is not a certifiable standard. ISO 31000:2018 is the current edition, and a revision is under development.

What is a key risk indicator?

A KRI is a measure linked to a specific risk that shows a change in its likelihood or consequence. An example is the number of customer reviews that are overdue.

Next steps

Start with a register of your main risks, an owner for each and the controls you rely on. Then test whether those controls work.

For regulated businesses, much of that work happens client by client. The Assess workflow in StackGo’s IdentityCheck gives each client a High, Medium or Low risk rating and records the decision against the client. See the Assess workflow, or read risk mitigation strategies.

Sources

The facts on this page come from these sources, checked on 21 October 2026. Standards and government guidance:

Law and regulator guidance: