Two BASK lists of four sit next to each other here, and the exam swaps them. Treatments are what you do about a risk. Types are what kind of risk it is.
The four risk treatments
Avoidance, reduction, sharing, retention.
- Avoidance — cease the activity altogether.
- Reduction — lower the probability or impact through controls.
- Sharing — transfer the financial consequence, for example to an insurer.
- Retention — absorb the loss on the organization's own balance sheet.
Duplication is not a treatment. Neither is the generic prevention, detection, correction, recovery taxonomy; the BASK does not use it here.
The four risk types
Hazard, financial, operational, strategic.
- Internal, external, systemic, residual is not the BASK's list.
- Physical, cyber, reputational, legal names common exposure categories, but not the four types.
- Known, unknown, emerging, retained mixes uncertainty labels with a treatment word.
Do not answer with the process
Identify, analyze, prioritize, monitor describes steps of the enterprise risk management process, not treatments. If the stem says "treatments," the answer is the avoidance list.
Working a scenario
A safety committee buys insurance for a low-frequency, high-severity event rather than eliminating the activity or absorbing the loss internally. That is sharing. The stem rules out the neighbours for you: "eliminating the activity" is avoidance, "absorbing the loss" is retention, and no control change is described, so it is not reduction.
Carry this in: four treatments, four types, and the ERM process is neither of them.