Strategic Business Leader · Managing, monitoring and mitigating risk

TARA Risk Framework: Risk Responses for SBL

Updated 11 October 2026 · Fact-checked

TARA is a framework of four risk responses: transfer, avoid, reduce and accept. After you assess a risk's likelihood and impact, you pick the response that fits the risk, the organisation's risk appetite and the cost of acting. In SBL, you must justify the choice using the scenario.

Understand Risk Responses: TARA Framework

Once a risk has been identified and assessed, the board must decide what to do about it. TARA gives four choices. It is a decision tool, not a way of finding risks.

Transfer means passing some or all of the financial effect of the risk to another party. Common routes are insurance, outsourcing, hedging, contract terms and joint ventures. The key point: you transfer the financial consequence, but you often keep the reputational and legal responsibility. A firm that outsources a call centre still answers to its customers.

Avoid means stopping the activity that creates the risk. You do not enter the market, you sell the division, you drop the product. It removes the risk fully. But it also removes the reward. Avoidance suits risks with high impact and high likelihood that the organisation cannot bear.

Reduce (also called mitigate) means keeping the activity but lowering the likelihood, the impact, or both. Examples are internal controls, staff training, security systems, diversification, contingency plans and staged project roll-outs. Accept (also called tolerate or retain) means doing nothing extra because the risk is within appetite or the cost of any response is higher than the benefit. Accepting should be a conscious, documented decision, not neglect.

A useful link is the likelihood and impact grid. Low likelihood, low impact risks are usually accepted. Low likelihood, high impact risks are often transferred, for example by insurance. High likelihood, low impact risks are usually reduced through controls. High likelihood, high impact risks are avoided or sharply reduced. Treat this as a guide, not a rule. Appetite, cost and strategy can change the answer.

Some texts use other labels, such as treat, tolerate, terminate and transfer. The ideas are the same. Use TARA labels unless the question uses different ones.

Key rules to remember

TARA responses: Transfer | Avoid | Reduce | Accept; Name the response, then say exactly what action it involves in the scenario.
Likelihood and impact guide: Low L, low I → Accept; Low L, high I → Transfer; High L, low I → Reduce; High L, high I → Avoid or Reduce; A rule of thumb only. Risk appetite, cost and strategic importance can override it.
Cost-benefit test for a response: Respond if expected benefit (loss prevented or reduced) > cost of the response; Use it to justify accepting a risk or rejecting an expensive control.
Residual risk: Residual risk = inherent risk − effect of the response; Conceptual, not numeric. After responding, check residual risk is within appetite.

How to solve Risk Responses: TARA Framework questions

Use this method for any question that asks you to recommend or evaluate risk responses in a scenario.

1Read the requirement. Note whether it asks you to identify, explain, recommend or evaluate responses, and for which risks.
2List each risk the scenario gives you. Pick the ones the requirement covers.
3Judge likelihood and impact for each, using scenario facts. Say whether it is high or low and why.
4Check risk appetite and strategy. Is the company cautious or growth-driven? Is the activity core to its strategy?
5Choose a TARA response per risk. State it by name and describe the specific action, such as insurance, a control or exit.
6Justify the choice with cost, benefit and the scenario facts. Say why the other options are weaker.
7Note limits and residual risk. For example, transfer may leave reputational damage, or reduction may need monitoring.
8Finish with a clear recommendation, in the format asked (report, email, briefing note).

Quickest way: Likelihood, impact, then one-line justification

When to use it: When you have little time and several risks to cover in one requirement.

Write the risk, then L/I as high or low in a few words.
Map it to the default TARA response from the grid.
Adjust once for appetite or cost if the scenario hints at it.
Write the specific action, not just the label.
Add one sentence of why, using a scenario fact.
Add one sentence on a limit, such as retained reputational risk.

Common mistakes in Risk Responses: TARA Framework

Only naming the response, such as 'transfer', with no action or scenario link.
Students memorise the four words and think that is enough.
Fix: Always give the specific action and tie it to a scenario fact, for example 'insure the cargo fleet because one loss would be severe'.
Confusing avoidance with reduction.
Both sound like 'making the risk smaller'.
Fix: Avoidance stops the activity completely. Reduction keeps the activity and adds controls. If the business still does the thing, it is not avoidance.
Saying transfer removes all the risk.
Insurance or outsourcing feels like handing the problem over.
Fix: State what remains: reputation, legal duties, excess payments, supplier failure. Transfer moves the financial effect, not always the accountability.
Treating acceptance as ignoring the risk.
Students see it as a weak answer and avoid it.
Fix: Present acceptance as a deliberate, monitored decision within appetite, used when response costs exceed benefits.
Recommending avoidance for every serious risk.
It looks safest.
Fix: Avoidance gives up the reward too. Weigh lost strategic value, and consider reducing or transferring if the activity is core.
Using generic risks and ignoring the scenario's appetite and numbers.
Students reuse textbook examples to save time.
Fix: Quote the company's facts, such as its size, sector and stated attitude to risk, to earn application and professional skills marks.

Worked examples

Example 1

Zenara Foods is a mid-sized exporter of packaged snacks. The board is cautious. Three risks are noted: (1) a major fire at its single factory, which is unlikely but would stop production for months; (2) frequent minor errors in customer invoices, with small financial effect; (3) plans to sell in a country with unstable government where payment is uncertain and losses have been frequent. Recommend a TARA response for each risk.

Show the solution

Risk 1: likelihood low, impact high. The firm has one factory, so the loss would be severe.
Default response is transfer. Recommend property and business interruption insurance. Reduction is also useful: sprinklers and fire drills lower likelihood and impact.
Risk 2: likelihood high, impact low. Avoiding invoicing is impossible, so avoidance does not fit.
Recommend reduce: automated invoice checks and staff training. Full elimination costs more than the small losses, so some residual error is accepted.
Risk 3: likelihood high and impact potentially high, and the board is cautious.
Recommend avoid: do not enter that market for now. Alternatives such as export credit insurance (transfer) could be reviewed if the market becomes strategically important.
Note limits: insurance does not repair lost customers or reputation, and avoiding the market gives up possible revenue.

Answer: Risk 1: transfer through insurance, supported by fire controls. Risk 2: reduce through automation and training, accepting small residual errors. Risk 3: avoid entering the market, given the high likelihood of loss and the board's cautious appetite.

Example 2

Kavi Tech develops software and wants to outsource payroll processing to a third party to cut costs. A director says, 'This transfers the risk, so we can stop worrying about payroll errors and data breaches.' Evaluate this statement.

Show the solution

Identify the response: outsourcing is a form of transfer, so the director is partly right.
Say what is transferred: day-to-day processing and some financial loss, if the contract has penalties or indemnities for supplier errors.
Say what is not transferred: Kavi Tech remains responsible to employees for correct pay and to regulators for protecting personal data. A breach would damage its reputation.
Add new risks created: dependence on the supplier, loss of control and supplier failure.
Recommend actions to reduce what remains: due diligence on the provider, a service level agreement with clear liability terms, audit rights and regular monitoring of output.
Conclude with a balanced view.

Answer: The statement is too strong. Outsourcing transfers processing work and some financial loss, but Kavi Tech keeps legal and reputational responsibility and takes on supplier risk. It should combine transfer with reduction through contract terms, due diligence and ongoing monitoring.

Exam tips

Link every response to a scenario fact. A correct label with no application earns little.
Use professional skills: weigh options and give a clear recommendation rather than a list.
Show the trade-off. Say what each response costs and what it gives up.
If the requirement asks for evaluation, comment on residual risk and monitoring, not just the choice.
Use the board's stated risk appetite as your deciding factor when the scenario gives one.

Practice questions from Managing, monitoring and mitigating risk

Risk Responses: TARA Framework: frequently asked questions

What does TARA stand for in ACCA SBL?

TARA stands for Transfer, Avoid, Reduce and Accept. These are the four responses an organisation can take to an assessed risk. You choose between them based on likelihood, impact, appetite and cost.

What is the difference between risk avoidance and risk reduction?

Avoidance means stopping the activity that creates the risk, such as withdrawing from a market. Reduction means continuing the activity but lowering the likelihood or impact through controls. Avoidance removes the risk and the reward. Reduction keeps both.

Does transferring a risk remove it completely?

No. Transfer usually moves the financial effect to another party, for example an insurer. The organisation often keeps reputational, legal and ethical responsibility, and may face new risks such as supplier failure.

How do I recommend a risk response in the SBL exam?

Assess likelihood and impact from the scenario, check the risk appetite, then name the TARA response and the specific action. Justify it with scenario facts and costs, and mention any residual risk. Keep the recommendation clear.