Risk Treatment Options

The previous two lessons built the list and ranked it on two scales, but recognized only a single response for each item. There are actually four responses. Mitigation adds a control and reduces the probability or the impact, transfer loads part of the loss onto someone else through a transfer agreement, acceptance carries the item as it is, avoidance gives up the work that creates the risk. All four are spent from the same budget but consume it in different units. This lesson converts them to a common unit, runs all four against the same list, and separately counts two things: what transfer does not hand over, and avoidance’s inability to enter the ranking.

Four Options, One Unit

Mitigation’s cost is a setup and a maintenance fee; the setup is paid once, the maintenance every year. Transfer’s cost is an annual premium, and the premium is the transferred risk multiplied by a loading coefficient. Avoidance’s cost is the annual value of the work given up; acceptance’s cost, and the risk it reduces, are both zero.

The common unit is the annual fictional unit: the setup cost is divided over three years and the maintenance is added; the premium and the given-up work value are already annual. Without this conversion, the comparison breaks silently.

• RM12. The coefficients, costs, transfer loadings and component distributions are all a model; the unit is the fictional unit.
• RM13. The avoidance cost is the annual work-value loss from giving up the work; an asset marked - cannot have its work given up.
• RM14. The transfer agreement covers the first two of the five components and does not cover the other three.
• RM15. All costs are converted to the annual unit: mitigation’s annual cost is the setup divided by three plus the annual maintenance.
• RM16. The budget is spent in order of ratio; an item that has already been taken is not handled a second time. Avoidance is an asset-level decision and closes all of an asset’s items at once.

// risk/option.mjs — same 47 items, four treatment options. THIS IS A MODEL; there is no real
// inventory, no real contract and no real currency, every cost is an annual "fictional unit".

// RM12: threat row: name | frequency | exposure ratio | ratio mitigation reduces |
// setup cost | annual maintenance | transfer loading ('-' cannot be transferred) |
// component distribution (percent): direct / interruption / remediation / notification / reputation
export const THREAT = `
  credential-theft     0.30  0.35  0.70  40   9  1.35  30 15 20 20 15
  malicious-code       0.50  0.25  0.60  30   8  1.50  25 35 25  5 10
  misconfiguration     0.80  0.15  0.75  12   5     -  20 45 25  0 10
  insider-misuse       0.10  0.40  0.40  55  12  1.80  35 10 15 20 20
  service-disruption   0.40  0.20  0.50  25   6  1.20  10 65 20  0  5
  physical-access      0.06  0.50  0.65  35   7  1.45  45 15 15 15 10
  supply-chain         0.08  0.45  0.30  60  14  1.60  30 25 20 10 15`
  .trim().split("\n").map((r) => {
    const [name, freq, exp, red, setup, maint, load, ...dist] = r.trim().split(/\s+/);
    return { name, baseFreq: +freq, exposureRatio: +exp, reduction: +red, setupCost: +setup,
      maint: +maint, transferLoading: load === "-" ? null : +load, componentDist: dist.map(Number) };
  });

// RM13: asset row: name | value | exposure multiplier | cost multiplier |
// annual avoidance cost ('-' the work cannot be given up) | threat mask
export const ASSET = `
  field-laptop           900  1.6  1.0    -  1111011
  branch-endpoint        600  1.2  1.0    -  1111110
  measurement-collector  750  1.4  1.5    -  0111110
  processing-server      1800  0.6  0.8    -  1111101
  perimeter-network      1200  1.8  0.6    -  0011100
  identity-directory     2400  1.0  0.7    -  1011100
  cloud-account          2000  1.5  1.4  620  1011100
  subscriber-database    3000  0.4  0.9    -  1011100
  field-application      1400  1.1  0.7  300  1111001
  supplier-connection    1000  1.3  1.2  260  1001101`
  .trim().split("\n").map((r) => {
    const [name, v, m, bk, kac, mask] = r.trim().split(/\s+/);
    return { name, value: +v, exposureMult: +m, costMult: +bk, avoidCost: kac === "-" ? null : +kac, mask };
  });

export const COMPONENT = ["direct", "interruption", "remediation", "notification", "reputation"];
// RM14: the transfer agreement covers the first two components and does not cover the other three.
export const COVERAGE = [1, 1, 0, 0, 0];

export const ITEM = [];
for (const v of ASSET)
  for (const t of THREAT.filter((_, j) => v.mask[j] === "1")) {
    const risk = +(t.baseFreq * v.exposureMult * v.value * t.exposureRatio).toFixed(2);
    // RM15: all costs are converted to the annual unit. Mitigation's annual cost is the setup
    // divided over three years plus the annual maintenance; the transfer premium is the
    // transferred risk times the loading.
    const mitCost = +(((t.setupCost / 3) + t.maint) * v.costMult).toFixed(2);
    const share = t.componentDist.reduce((a, x, i) => a + x * COVERAGE[i], 0) / 100;
    ITEM.push({ v, t, risk,
      mitigation: { cost: mitCost, reduction: +(risk * t.reduction).toFixed(2) },
      transfer: t.transferLoading === null ? null
        : { cost: +(risk * share * t.transferLoading).toFixed(2), reduction: +(risk * share).toFixed(2), share },
    });
  }
for (const k of ITEM)
  for (const s of ["mitigation", "transfer"])
    if (k[s]) k[s].ratio = +(k[s].reduction / k[s].cost).toFixed(3);

// Avoidance is an asset-level decision: it removes all of an asset's items from the list.
export const AVOIDANCE = ASSET.filter((v) => v.avoidCost !== null).map((v) => {
  const items = ITEM.filter((k) => k.v === v);
  const reduction = +items.reduce((a, k) => a + k.risk, 0).toFixed(2);
  return { v, items, cost: v.avoidCost, reduction, ratio: +(reduction / v.avoidCost).toFixed(3) };
});
export const TOTAL = +ITEM.reduce((a, k) => a + k.risk, 0).toFixed(2);

The Same Budget, Four Strategies

// risk/race.mjs — four options run under the same budget; the accepted remainder is counted separately
import { ITEM, AVOIDANCE, TOTAL, COMPONENT, COVERAGE } from "./option.mjs";

const y = (g, ...s) => console.log(s.map((v, i) =>
  (g[i] < 0 ? String(v).padEnd(-g[i]) : String(v).padStart(g[i]))).join("").trimEnd());
const TRANSFERABLE = ITEM.filter((k) => k.transfer);
const candidate = (L, field) => L.map((k) => ({ ...k[field], option: field, items: [k] }));
const BEST = ITEM.map((k) => (k.transfer && k.transfer.ratio > k.mitigation.ratio
  ? { ...k.transfer, option: "transfer", items: [k] } : { ...k.mitigation, option: "mitigation", items: [k] }));
const MIXED = [...BEST, ...AVOIDANCE.map((x) => ({ ...x, option: "avoidance" }))];

// The budget is spent in order of ratio; an item that has been taken is not handled a second time.
const run = (candidates, budget) => {
  const taken = new Set(); const chosen = [];
  let spent = 0, reduced = 0;
  for (const a of [...candidates].sort((x, z) => z.ratio - x.ratio))
    if (!a.items.some((k) => taken.has(k)) && spent + a.cost <= budget) {
      a.items.forEach((k) => taken.add(k)); spent += a.cost; reduced += a.reduction; chosen.push(a);
    }
  return { chosen, taken, n: chosen.length, spent: +spent.toFixed(2), reduced: +reduced.toFixed(2),
    accepted: +(TOTAL - reduced).toFixed(2) };
};

console.log(`${ITEM.length} items, total annual risk ${TOTAL} fictional units`);

const A = [-10, 9, 10, 10, 10, 9];
console.log("\n1. applicability and ratio per option (risk reduced / annual cost)");
y(A, "option", "units", "lowest", "highest", "average", "decision");
for (const [option, L, f, unit] of [["mitigation", ITEM, (k) => k.mitigation.ratio, "item"],
  ["transfer", TRANSFERABLE, (k) => k.transfer.ratio, "item"],
  ["avoidance", AVOIDANCE, (x) => x.ratio, "asset"]]) {
  const o = L.map(f);
  y(A, option, L.length, Math.min(...o).toFixed(3), Math.max(...o).toFixed(3),
    (o.reduce((a, x) => a + x, 0) / o.length).toFixed(3), unit);
}
console.log("acceptance   47 items, cost 0, risk reduced 0: it is the default for every item not chosen");
console.log("items where transfer's ratio beats mitigation's: " +
  `${TRANSFERABLE.filter((k) => k.transfer.ratio > k.mitigation.ratio).length}`);

const B = [-22, 7, 10, 13, 13, 12];
console.log("\n2. 300-unit annual budget, four strategies");
y(B, "strategy", "chosen", "spent", "risk reduced", "accepted", "remaining %");
for (const [label, L] of [["mitigation only", candidate(ITEM, "mitigation")],
  ["transfer only", candidate(TRANSFERABLE, "transfer")], ["avoidance only", AVOIDANCE],
  ["mixed", MIXED]]) {
  const r = run(L, 300);
  y(B, label, r.n, r.spent.toFixed(2), r.reduced.toFixed(2), r.accepted.toFixed(2),
    ((r.accepted / TOTAL) * 100).toFixed(1));
}

const C = [-13, 12, 8, 15, 8];
console.log("\n3. what transfer takes over and does not, by component (38 transferable items)");
y(C, "component", "coverage", "items", "units carried", "share %");
const carried = (i) => +TRANSFERABLE.reduce((a, k) => a + k.risk * k.t.componentDist[i] / 100, 0).toFixed(2);
for (const [i, name] of COMPONENT.entries())
  y(C, name, COVERAGE[i] ? "transferred" : "retained", TRANSFERABLE.length, carried(i).toFixed(2),
    ((carried(i) / TOTAL) * 100).toFixed(1));
const transferred = COMPONENT.reduce((a, _, i) => a + COVERAGE[i] * carried(i), 0);
const total = ITEM.length * COMPONENT.length, moved = TRANSFERABLE.length * COVERAGE.filter(Boolean).length;
console.log(`${total} component items: ${moved} are transferred, ${total - moved} remain; ` +
  `transferred ${transferred.toFixed(2)}, remaining outside ${(TOTAL - transferred).toFixed(2)} units`);

const D = [-8, 7, 10, 13, 11, 9, 10];
console.log("\n4. as the mixed strategy's budget grows: which option enters the list");
y(D, "budget", "chosen", "spent", "risk reduced", "mitigation", "transfer", "avoidance");
for (const b of [300, 600, 900, 1200]) {
  const r = run(MIXED, b);
  const count = (option) => r.chosen.filter((a) => a.option === option).length;
  y(D, b, r.n, r.spent.toFixed(2), r.reduced.toFixed(2), count("mitigation"), count("transfer"), count("avoidance"));
}

const r300 = run(MIXED, 300);
const unopened = ITEM.filter((k) => !r300.taken.has(k));
const unopenedRisk = +unopened.reduce((a, k) => a + k.risk, 0).toFixed(2);
const largestSingle = unopened.reduce((a, k) => (k.v.value * k.t.exposureRatio > a.v.value * a.t.exposureRatio ? k : a));
console.log(`\n5. accepted under the 300-unit mixed strategy: ${r300.accepted.toFixed(2)} units`);
console.log(`${unopened.length} items never opened, ${unopenedRisk} units; the ${r300.n} items handled ` +
  `have a remainder of ${(r300.accepted - unopenedRisk).toFixed(2)} units`);
console.log(`largest single loss among the unopened: ${largestSingle.v.name} / ${largestSingle.t.name}, ` +
  `annual ${largestSingle.risk.toFixed(2)}, single ${(largestSingle.v.value * largestSingle.t.exposureRatio).toFixed(1)} units`);

const F = [-22, 8, 7, 10, 9];
console.log("\n6. why avoidance is never chosen (1,200-unit budget)");
y(F, "asset", "ratio", "items", "preempted", "cost");
const r1200 = run(MIXED, 1200);
for (const x of AVOIDANCE)
  y(F, x.v.name, x.ratio.toFixed(3), x.items.length,
    x.items.filter((k) => r1200.chosen.some((a) => a.ratio > x.ratio && a.items.includes(k))).length,
    x.cost);

47 items, total annual risk 5768.61 fictional units

1. applicability and ratio per option (risk reduced / annual cost)
option        units    lowest   highest   average decision
mitigation       47     0.344    36.000     6.286     item
transfer         38     0.556     0.833     0.686     item
avoidance         3     1.305     2.187     1.720    asset
acceptance   47 items, cost 0, risk reduced 0: it is the default for every item not chosen
items where transfer's ratio beats mitigation's: 5

2. 300-unit annual budget, four strategies
strategy               chosen     spent risk reduced     accepted remaining %
mitigation only            22    295.40      2746.71      3021.90        52.4
transfer only               4    291.60       243.00      5525.61        95.8
avoidance only              1    300.00       656.04      5112.57        88.6
mixed                      22    295.40      2746.71      3021.90        52.4

3. what transfer takes over and does not, by component (38 transferable items)
component        coverage   items  units carried share %
direct        transferred      38        1008.57    17.5
interruption  transferred      38        1252.34    21.7
remediation      retained      38         803.40    13.9
notification     retained      38         463.58     8.0
reputation       retained      38         489.92     8.5
235 component items: 76 are transferred, 159 remain; transferred 2260.91, remaining outside 3507.70 units

4. as the mixed strategy's budget grows: which option enters the list
budget   chosen     spent risk reduced mitigation transfer avoidance
300          22    295.40      2746.71         22        0         0
600          36    595.93      3386.45         36        0         0
900          45    887.04      3579.51         42        3         0
1200         47    944.39      3611.37         42        5         0

5. accepted under the 300-unit mixed strategy: 3021.90 units
25 items never opened, 1699.81 units; the 22 items handled have a remainder of 1322.09 units
largest single loss among the unopened: subscriber-database / insider-misuse, annual 48.00, single 1200.0 units

6. why avoidance is never chosen (1,200-unit budget)
asset                    ratio  items preempted     cost
cloud-account            1.669      4         3      620
field-application        2.187      5         3      300
supplier-connection      1.305      4         2      260

The numbers are in the measurement class; its inputs are RM12–RM16.

Where the Ratios Split

The first table compares the four options in a single column. Mitigation’s ratio ranges from 0.344 to 36.000, averaging 6.286. Transfer’s ratio is between 0.556 and 0.833, and none of it ever passes 1. This is not a flaw, it is the definition itself: the premium is the transferred risk times a loading, and the loading is greater than one. In an expected-value sense, transfer inevitably costs more than it returns.

The same row also shows what transfer is actually for: transfer buys variance, not the average, and the ratio column does not measure variance. Avoidance’s ratio is between 1.305 and 2.187 and applies to only three assets. Acceptance’s ratio is undefined; acceptance looks like an option, but it is the default for every item that is not chosen.

Same Budget, Four Outcomes

The second table spends the 300-unit annual budget on four strategies. Mitigation alone makes 22 decisions and reduces risk by 2,746.71 units; 52.4 percent of the total remains accepted. Transfer alone makes 4 decisions with the same budget and reduces 243.00 units. Avoidance alone makes a single decision, spends all 300 units on one item, and reduces 656.04 units.

The mixed strategy takes the best-ratio option for every item, and its outcome is identical to mitigation alone. Transfer’s ratio beats mitigation’s in five items, but since the highest of those five is 0.833, the budget never reaches them. An option that is better for a given item never shows up in the budget unless it reaches the top of the list.

The fourth table looks for the threshold: at 600 units, all 36 decisions are still mitigation; at 900 units, the first three transfer decisions enter; at 1,200 units, there are five. As the decision count rises from 45 to 47, the risk reduced grows by only 31.86 units.

What Transfer Does Not Hand Over

The third table counts transfer’s coverage as component items. An incident’s loss splits into five parts: direct loss, interruption, remediation effort, notification obligation and reputation. The transfer agreement takes over the first two and does not take the other three.

The count comes out in two forms. As items, 47 items across five components produce 235 component items; the agreement takes over 76 of them, and 159 stay with the organization. As units, the transferred amount is 2,260.91, and the amount left outside is 3,507.70 units.

The remaining three components share something in common: none of them closes by paying money. Remediation effort is the organization’s own time, notification is the organization’s own task, reputation is not bought back with a price. Transfer hands over a loss, not a task.

Avoidance’s Inability to Enter the Ranking

The sixth table gives this lesson’s structural finding. Avoidance’s ratio, across three assets, is between 1.305 and 2.187 and is higher than every transfer ratio; yet even under a 1,200-unit budget, no avoidance decision is ever chosen. The reason is in the count: avoidance is a single decision that closes all of an asset’s items at once, but the ranking is done at the item level. Three of field-application’s five items are already taken by item-level decisions with a ratio higher than avoidance’s 2.187; the same holds for three of four in cloud-account and two of four in supplier-connection.

The ranking does not eliminate avoidance, it makes it unreachable. What is wrong is not the ranking itself but at which level it is done: an asset-level option can only be compared against an asset-level list.

Acceptance’s Silent Share

The fifth line writes out what is left after the budget runs out. Of the 3,021.90 accepted units, 1,699.81 comes from 25 items that were never opened, and 1,322.09 comes from the remainder of 22 items that were handled. The two numbers are written separately because they are separate questions: the first is “we did not look”, the second is “we looked and it was not enough”.

Among the items never opened, the one carrying the largest single loss is insider misuse on the subscriber database: an annual 48.00 units, with a single loss of 1,200.0 units. Because its annual value is small, both rankings push it to the back; yet it is exactly the item where the transfer agreement would do the most good in terms of variance. This is why the choice cannot be made from a single column: the ratio carries the average, transfer carries the tail, and acceptance carries whatever is left outside both.

Summary

• The four options cannot be compared until they are converted to a common annual unit: the setup cost is divided by three and the maintenance is added, the premium and the given-up work value are already annual, and acceptance’s cost is zero.
• Transfer’s ratio is between 0.556 and 0.833 and never passes 1; transfer buys variance, not the average.
• Under a 300-unit budget, mitigation alone reduces 2,746.71 units with 22 decisions, transfer alone reduces 243.00 with 4 decisions, and avoidance alone reduces 656.04 with a single decision; the mixed strategy produces the same outcome as mitigation alone.
• The transfer agreement takes over 76 of 235 component items, leaving 159 with the organization; 2,260.91 units are transferred, 3,507.70 remain outside, and the remaining three components do not close by paying money.
• Avoidance is an asset-level decision, and even though its ratio is high, it is never chosen even under a 1,200-unit budget: several of the asset’s items have already been taken by higher-ratio item-level decisions.
• Of the 3,021.90 accepted units, 1,699.81 comes from 25 items that were never opened; the largest among the unopened items is the one recording an annual 48.00 units with a single loss of 1,200.0 units.

Next Step

Across three lessons, the list stayed fixed: 47 items, ten assets, seven threats. Every ranking and every budget assumed this list was complete. Yet every item was derived from an asset record, and something kept those records: an inventory. A server that is not in the inventory, or a service a team stood up on its own, never enters a single pairing, is never written into a ranking, and takes no place in any budget — it does not even count as accepted, because acceptance requires at least a record. The next lesson counts the items left out of the inventory and measures a single question: how many positions in the ranking would change if these items entered the list.