The 6.5 Ts: rationalising security and risk management strategies

Known strategies for responding to risk or insecurity help us to establish our options, make choices, follow best practices, behave commonly or interoperably with our partners and communicate about our behaviours with a common understanding. Unfortunately, different risk management authorities offer incompatible or incomplete strategies. For instance, no authority admits diversification, a routine strategy in many domains, especially finance. Similarly, no authority explicitly admits the possibility of turning a risk from negative to positive. This article reviews what is meant by a strategy, reviews and aligns currently prescribed strategies and rationalises the following strategies in detail: tolerate; treat (which sometimes leads to terminate); turn; take; transfer; and thin.