Risk reduction
Risk reduction introduces measures intended to lower the likelihood or consequences of an exposure. Preventive measures may reduce the chance of an event, while protective, detective, recovery or continuity measures can limit its effects. The remaining exposure must still be assessed and monitored, since controls may fail or conditions may change.
Worked example
A retailer restricts access to customer data, checks unusual downloads and tests its incident response plan. The measures address different aspects of the data-loss exposure; none justifies a claim that a breach has become impossible.
Common mistake
A planned control has not reduced risk merely because it is written in a policy. Evaluate implementation, effectiveness and remaining exposure.
Where it appears in your exams
| Qualification | Exam | Relationship | Period |
|---|---|---|---|
| ACCA | SBL | Direct | September 2026–June 2027 |