The Four Types of Risk Management Strategies

Hand a safety manager somebody else’s risk register and the first question back is almost always about the four strategies. They were taught avoidance, reduction, transfer, and acceptance as four neat boxes, and they want to know which box each line belongs in. I field that question more often than any other about risk.

The four are useful. They are also not what Australian law asks you for, and the gap between the two is where people get caught. Here is what each one means, what it looks like on a site with contractors on it, and why reaching for transfer or acceptance can leave a business exposed under the WHS Act.

Where the Four Strategies Come From.

The four are risk-treatment vocabulary from general business risk management, not from work health and safety law. Queensland Treasury’s guide to risk management, which is built on the Australian and New Zealand standard AS/NZS ISO 31000, sets out the options an organisation chooses between: treat the risk, transfer it, terminate the activity, take the opportunity it presents, or accept the risk rather than treat it.¹ Its glossary defines risk avoidance as an informed decision not to become involved in, or to withdraw from, a risk situation, and risk transfer as shifting the burden for loss to another party through legislation, contract, insurance, or other means.¹

WHS law is narrower and harder. Section 17 of the model Work Health and Safety Act requires a duty holder to eliminate risks to health and safety so far as is reasonably practicable and, if that is not reasonably practicable, to minimise those risks so far as is reasonably practicable.² The model laws have been implemented in every Australian jurisdiction except Victoria.³

There is no third option in that sentence. Avoidance and reduction are instructions from the Act. Transfer and acceptance are business decisions that sit alongside the duty and never stand in for it.

Avoidance Means Removing the Hazard, Not the Job.

Avoidance in WHS terms is elimination, and Safe Work Australia’s code of practice is blunt about where it sits: you must always aim to eliminate the risk, which is the most effective control, and only minimise by working through the other alternatives if elimination is not reasonably practicable.⁴

The code’s own example is the one worth remembering, because it is not “stop doing the work”. You eliminate the risk of a fall from height by doing the work at ground level.⁴ Prefabricating a handrail on the deck rather than at the edge, or specifying a water-based product instead of a solvent-based one: both avoidance, neither cancelling the job.

Timing is the part people miss. The code notes that eliminating hazards is often cheaper and more practical at the design or planning stage, when there is still scope to design the hazard out.⁴ By the time a risk reaches a register, most of the cheap avoidance has gone.

Falls from a height accounted for 24 of the 188 worker deaths recorded in Australia in 2024, second only to vehicle incidents at 79.⁵ Elimination is the only one of the four that removes the possibility instead of managing it.

Reduction Is the Hierarchy of Controls, in Order.

Reduction, which you will also see called mitigation, is where most safety work actually lives, and Australian law is specific about how it is done. Regulation 36 of the model WHS Regulations says that where it is not reasonably practicable to eliminate a risk, you minimise it by substituting the hazard with something that gives rise to a lesser risk, isolating the hazard from any person exposed to it, or implementing engineering controls. If a risk then remains, you add administrative controls. If a risk still remains, you provide suitable personal protective equipment.⁶

That order is not a preference. The code of practice says administrative controls and PPE are the least effective at minimising risk because they do not control the hazard at the source and rely on human behaviour and supervision, and should be used only to back up a higher control, as a short-term interim measure, or as a last resort.⁴ Combining controls is allowed, and expected, where one is not enough on its own.⁶

This is the first test I apply to any register I am shown. If most of the controls are inductions, toolbox talks, procedures, and hard hats, the risk has been documented rather than reduced. Those are the bottom two rungs, and an inspector reads them the same way.

Transfer Moves the Money, Never the Duty.

This is the one that catches principal contractors, so it is worth being direct about it.

You can transfer financial consequence. Insurance, indemnities, and contract terms decide who pays when something goes wrong, which is exactly what the business definition of transfer describes.¹ You cannot transfer the work health and safety duty. Section 14 of the model Act says a duty cannot be transferred to another person. Section 16 says more than one person can concurrently have the same duty, that each must comply to the standard the Act requires even where another duty holder has the same duty, and that each retains responsibility for their own. Section 272 makes void any contract term purporting to transfer a duty owed under the Act.² The code of practice compresses that into one line addressed to a PCBU, a person conducting a business or undertaking, entering a contract: remember that you cannot transfer your responsibilities to another person.⁴

On penalties the Act goes further still. Section 272A makes it an offence to enter into, provide, or take the benefit of insurance or an indemnity covering all or part of a liability for a monetary penalty under the Act, and voids any term that purports to cover one.² The fine is not an insurable risk. It is yours.

None of that makes transfer pointless. Engaging a specialist genuinely better equipped to control a hazard is good practice, and the code expects you to consult, cooperate, and coordinate with every other duty holder rather than assume somebody else has it in hand.⁴ What the arrangement does not do is take you out of the duty. On a construction site with dozens of subcontractors, a lapsed policy or a generic method statement is your exposure as much as theirs. That is the argument for checking certificates and their expiry dates at the gate rather than after the incident,⁷ and it is what contractor prequalification is for.

Acceptance Is a Decision You Have to Defend.

Acceptance is the informed choice to carry a risk rather than treat it further. Queensland Treasury lists the honest reasons for it: the probability or consequence is low or minor, the cost of treatment outweighs the benefit, the risk falls inside the organisation’s stated appetite, or the organisation has limited or no control over it, as with a natural disaster.¹

In WHS that is much narrower than it sounds, because the duty is not to manage risk down to a level the business finds acceptable. Section 18 of the model Act sets out what goes into the judgement of what is reasonably practicable: the likelihood of the hazard occurring, the degree of harm that might result, what the person knows or ought reasonably to know about the hazard and the ways of eliminating or minimising it, the availability and suitability of those ways, and then the cost, including whether it is grossly disproportionate to the risk.² Cost is last on that list, and the code adds that cost may be taken into account but cannot be used as a reason for doing nothing.⁴

Residual risk you have decided to live with after working the hierarchy is legitimate, and it belongs on the register with an owner, a score, and the reasoning attached. ComplyFlow keeps both numbers on each risk: the initial score from your matrix, and a residual score the owner sets once the controls are in.⁸ Untreated risk quietly filed as accepted is a different thing, and it is the one a regulator finds.

How the Four Line Up Against the Hierarchy.

The mapping is straightforward, and it is the reason the four are still worth using.

• Avoidance is elimination: the top of the hierarchy, and the first thing section 17 asks for.
• Reduction is everything below it, in the order regulation 36 sets: substitution, isolation, engineering controls, administrative controls, and PPE.
• Transfer sits outside the hierarchy. It changes who pays, not what a worker is exposed to.
• Acceptance sits at the end, and only after the hierarchy has been worked through.

Two of the four are controls. Two are decisions about money on a risk you still hold. A register that treats all four as equally available drifts towards the cheap two, because they take the least effort to write down.

The Three Questions This Post Does Not Answer.

This post is the treatment decision. The rest of the risk work is answered elsewhere on this blog, deliberately kept separate.

For the procedure, who identifies a hazard, who scores it, and what is written down at each of the four steps, read A Step-by-Step Guide to Conducting a Risk Assessment. For why an assessment is required at all and what happens when one has not been done, read Understanding the Importance of Conducting Risk Assessments. For the artefact itself, what belongs in each row and who keeps it current, read The Role of a Risk Register in Effective Risk Management.

Audit the Top Ten Rows Against the Hierarchy.

Take the top 10 lines of your register and write down which of the four you have actually chosen for each. Then check the choice against the hierarchy. If it is reduction, is the control an engineering one or a sign on a fence. If it is transfer, is there a current certificate sitting behind it. If it is acceptance, is the reasoning written somewhere an inspector could read it in five years.

Most registers I see carry more acceptance than anyone intended, because a risk with no owner and no review date has been accepted by default. That is the whole argument for a scheduled review: in ComplyFlow’s risk register every owner receives an action for each risk they own, and they update the controls and the residual score against it. Worth knowing before you lean on it: a manager with organisation-level risk permissions can close a review while actions are still outstanding, and those outstanding actions are then deleted rather than carried forward.⁹ Closing a review is a decision a person makes, not a state the system arrives at on its own, and that is the moment acceptance happens by default if nobody is looking.

The four strategies are a good way to think about a risk. The hierarchy is what you are held to. Keep both on the page and the register stops being something you maintain for an audit and starts telling you which site to visit first.