There are four main types of mitigation action or strategy: acceptance, avoidance, limitation and transference.

• Acceptance means accepting the risk and taking no action to mitigate it. It is a reasonable strategy for a risk that will only have a small impact, or is unlikely to happen, and where taking any action to mitigate it could be disproportionately expensive, but it is not going to work for every risk on your list.
• Avoidance means making every effort to avoid the risk. This strategy is normally very expensive, and only worthwhile for catastrophic risks that are almost certain to happen.
• Limitation is the most usual mitigation strategy, which aims to limit either the likelihood or the impact of the risk, and therefore reduce the effect that it will have on the business or project. It is a bit like a hybrid acceptance/avoidance strategy.
• Transference is the transfer of risk to someone else who is prepared to accept it. This is a strategy used by a lot of companies to avoid having to undertake activities which are not part of their core competences but would be a problem if they went wrong. It includes, for example, outsourcing of payroll management.