What is risk avoidance?
Risk avoidance eliminates a risk by eliminating its source. If the organization does not run the service, keep the data or enter the market, the associated risk cannot occur. It is one of the four risk treatments, alongside mitigation, transference and acceptance, and it is the only one that leaves no residual risk from the activity that was dropped.
Examples of risk avoidance
- A retailer stops storing card numbers after each transaction, avoiding the risk of a stolen card database.
- A company deletes a ten-year archive of former customers' records it has no legal reason to keep.
- IT decommissions an internet-facing legacy application that can no longer be patched.
- A product team drops a planned feature that would collect location data it cannot adequately protect.
- A firm declines to expand into a country whose data localization rules it cannot meet.
- A hospital postpones a patient-facing mobile app because it cannot be secured and tested in time.
The cost of avoidance
Avoidance is not free. The organization gives up whatever the activity was worth: revenue from a market, convenience from a feature, insight from retained data. It makes sense when the benefit is small compared with the risk, or when no combination of mitigation, transfer and acceptance can bring the risk within the organization's risk appetite. No business can avoid every risk, because the activities that create risk are usually the ones that create value.
Avoidance can also move risk instead of removing it. Retiring an old application helps only if its data is migrated or destroyed properly and the old servers are sanitized, and dropping an in-house service in favor of a vendor creates third-party risk in its place.
How to tell avoidance from mitigation
Ask whether the activity continues. If the service keeps running with protections added, the risk is being mitigated. If the service, data or plan goes away, the risk is being avoided.
| Action | Treatment |
|---|---|
| Disable one vulnerable feature in an application that stays in production | Mitigation |
| Shut the application down entirely | Avoidance |
| Encrypt the old customer archive | Mitigation |
| Delete the old customer archive | Avoidance |
Risk avoidance vs. acceptance and transference
- Avoidance removes the activity, so there is nothing left to accept.
- Acceptance keeps the activity and the risk, backed by a documented decision.
- Transference keeps the activity but shifts some of the financial impact to an insurer or provider, while accountability stays with the organization.
Risk avoidance on the CompTIA Security+ exam
Avoidance is one of the risk treatment options in SY0-801 objective 5.2. Look at the verb in the scenario: discontinuing a service, decommissioning a system, deleting data the organization does not need, cancelling a project or declining a business opportunity because of the risk all point at avoidance. The usual distractors are mitigation, where protections are added but the activity continues; transference, where insurance or a contract shifts the cost; and acceptance, where management keeps the activity and signs for the risk. A scenario that patches or disables part of a system that stays in use describes mitigation, not avoidance.