After a hazard is analyzed, risk can be established. Managers want to deal in risk rather than hazards because hazards do not have an explicit mission connection. Determine which risks can be eliminated, reduced or controlled in some manner. If you did the previous step correctly, you'll know which one to concentrate on first. A risk control must change the risk by impacting the exposure, severity or the probability of a mishap.
Controls usually cost something in terms of an investment of time or money.
First, select the best possible risk controls. Next, decide if those controls will assure that the benefits will outweigh the costs. This decision making process should involve the right person making the decision at the right time, based on the right inputs. Whoever has the best grasp of the risk and the opportunity issues. The organizational leaders should push the average risk decision down the chain of command over time because the detail and understanding of the decision implications increases the closer you get to the principle participants of an activity.