Risk mitigation measures are usually formulated according to one or more of the following major risk options, which are:
1) Design a new business process with adequate built-in risk control and containment measures from the start.
2) Periodically re-assess risks that are accepted in ongoing processes as a normal feature of business operations and modify mitigation measures.
3) Transfer risks to an external agency (e.g. an insurance company)
4) Avoid risks altogether (e.g. by closing down a particular high-risk business area)
Remember: Insurance is risk transfer and is usually the most expensive way to deal with risk.