Once you understand the risks that could harm your business, you can decide on what strategies to use. These could either remove the likelihood of them happening, or could help to mitigate the impact if they did.

Options available

It's generally considered that there are four broad options available. You could:

1. Accept the risk and do nothing - this might be appropriate if the cost of doing something to reduce the risk was greater than the potential damage from the risk
2. Accept the risk but seek mutual aid - you could achieve this by having a 'buddy' agreement with another business you'd share facilities and resources with if one of the businesses were affected by an incident
3. Reduce the risk by taking mitigating actions - an example would be having tried and tested backup and recovery arrangements for IT data
4. Remove the risk by stopping the activity or changing a process that carries too much risk to one that is more manageable