CFA Level I Exam · Introduction to Risk Management

Risk Management Methods: Avoid, Accept, Transfer, Shift

Updated 7 October 2026 · Fact-checked

Risk management methods are the ways a firm responds to a risk it has identified. The curriculum lists risk prevention and avoidance, risk acceptance (including self-insurance), risk transfer, and risk shifting. To solve exam questions, match the action in the stem to its definition, then check whether the risk is removed, retained, moved, or reshaped.

Understand Risk Management Methods: Avoid, Mitigate, Transfer, Share

Once a firm has identified and measured a risk, it must decide what to do. This decision is called risk modification or risk response. The CFA curriculum lists the responses as risk prevention and avoidance, risk acceptance (including self-insurance), risk transfer, and risk shifting. Each has a clear meaning, and exam questions test whether you can tell them apart.

Risk prevention and avoidance is a single response: choosing not to undertake the activity that creates the risk. A bank that decides never to lend in a certain country avoids that country's credit risk. This response also gives up the possible reward.

Risk acceptance means knowingly bearing the risk. Some risks are small, or cost more to remove than they are worth. Acceptance can be active (you have measured it and chosen to keep it) or passive (you have not recognised it). Within acceptance, a firm may self-insure, setting aside its own funds to cover losses.

Risk transfer moves the risk to another party, usually by buying insurance or through a surety or similar contract. The classic case is an insurance policy: the insurer takes on the loss in return for a premium. Risk shifting changes the shape of the probability distribution of outcomes, not who owns the risk. Using derivatives to reduce downside while keeping some upside is risk shifting. Be careful here: transfer is about moving risk to someone else, and shifting is about altering the distribution of outcomes.

In general practice, risk managers also separate actions that lower the likelihood of a loss (for example, stronger controls) from actions that lower the size of a loss if it happens (for example, backup sites). This likelihood versus severity split is a general risk-management distinction, not curriculum terminology, so do not expect it as a labelled category. Many firms use a mix of responses. The choice depends on the firm's risk tolerance, the cost of each method, and whether the risk is worth taking for the return it offers.

Key formulas to remember

Risk prevention and avoidance: Do not undertake the activity; Removes the risk and also the possible return.
Risk acceptance: Retain the risk; active (measured) or passive (unrecognised); self-insurance sets aside own funds; Fits risks that are small or too costly to remove.
Risk transfer: Move the risk to another party, e.g. insurance premium paid for loss cover; Another party bears the loss. Cost is the premium.
Risk shifting: Change the distribution of outcomes, e.g. with derivatives; Alters the shape of outcomes, such as cutting downside while keeping upside.
Likelihood versus severity (general practice): Controls lower the chance of loss; other actions lower the size of loss; A general risk-management distinction, not a separate curriculum category.
Choosing a method: Compare cost of the method with the risk's expected loss and the firm's risk tolerance; A risk should be retained only if it fits risk tolerance and offers adequate reward.

How to solve Risk Management Methods: Avoid, Mitigate, Transfer, Share questions

Use this order for any question on risk responses.

1Identify the risk and what the firm or person is doing about it.
2Ask: is the activity stopped completely? If yes, it is prevention and avoidance.
3Ask: is the outcome distribution reshaped, for example a forward or an option used to cut downside and keep upside? If yes, it is shifting, even though a counterparty is on the other side of the derivative.
4Ask: does an insurance-type contract, such as a policy or a surety, put the loss on a third party in return for a premium? If yes, it is transfer.
5If nothing is done, or funds are set aside internally, it is acceptance or self-insurance.
6If the question asks which method is best, compare the cost, the firm's risk tolerance and the return from the activity.
7Eliminate the two options that fail your test and pick the remaining one.

Quickest way: Three-question filter

When to use it: Use when you have about 90 seconds and the stem describes a single action.

Is the activity dropped? Prevent and avoid.
Is a derivative used to reshape the outcome pattern, such as cutting downside and keeping upside? Shift.
Does an insurance-type contract put the loss on a third party for a premium? Transfer.
Otherwise, the firm keeps the risk: accept.

Common mistakes in Risk Management Methods: Avoid, Mitigate, Transfer, Share

Calling insurance risk shifting.
Both words sound like moving risk.
Fix: Insurance moves the loss to the insurer, so it is transfer. Shifting changes the distribution of outcomes.
Treating prevention and avoidance as two separate curriculum responses.
In everyday language, prevention sounds like reducing the chance of loss.
Fix: In the curriculum, prevention and avoidance is one response: not undertaking the activity. The likelihood versus severity split is a general practitioner distinction.
Thinking avoidance is always the safest and best choice.
It removes the risk completely.
Fix: Avoidance also removes the return. The best choice depends on cost, risk tolerance and reward.
Assuming acceptance means the firm ignored the risk.
The word sounds passive.
Fix: Acceptance can be active: the risk is measured and deliberately retained, perhaps with self-insurance.
Choosing a method without looking at cost.
Students focus only on which method removes the most risk.
Fix: Check whether the cost of the method is justified by the expected loss it covers.

Worked examples

Example 1

A manufacturer worries about fire damage at its main plant. It pays an annual premium to an insurer, which will cover losses from a fire. Which risk response is this? A. Risk prevention and avoidance B. Risk acceptance C. Risk transfer

Show the solution

The firm still operates the plant, so the activity continues. This rules out prevention and avoidance (A).
The firm pays a premium and does not bear the loss itself. This rules out acceptance (B).
The loss is borne by the insurer in return for the premium. That is risk transfer.

Answer: C. Risk transfer

Example 2

A food company decides to stop selling a product line in a country because it judges the legal and credit risks there to be too high. Which risk response is this? A. Risk acceptance B. Risk prevention and avoidance C. Risk transfer

Show the solution

The company stops the activity that creates the risk. That is prevention and avoidance (B).
It does not keep the risk, so it is not acceptance (A).
No third party takes over the loss, so it is not transfer (C).

Answer: B. Risk prevention and avoidance

Exam tips

Look for the key verb: stop, buy insurance, reshape payoffs, set aside funds.
Insurance and similar contracts that put the loss on another party are transfer, not shifting.
Use the curriculum's four responses as your labels; treat likelihood versus severity as background only.
For best-method questions, tie the choice to cost, risk tolerance and the reward from the activity.
With no penalty for wrong answers, always answer; eliminating two options gives you a clear choice.

Practice questions from Introduction to Risk Management

Risk Management Methods: Avoid, Mitigate, Transfer, Share: frequently asked questions

What is the difference between risk transfer and risk shifting?

Risk transfer moves the risk to another party, such as an insurer, in exchange for a premium. Risk shifting changes the distribution of outcomes, for example reducing downside while keeping some upside through derivatives.

What is the difference between risk avoidance and risk acceptance?

Avoidance means not taking the activity at all, so the risk and the return both disappear. Acceptance keeps the activity and bears the risk, either knowingly or without having recognised it.

How do I choose a risk management strategy?

Compare the cost of each method with the expected loss and the return from the activity. Then check the result against the firm's risk tolerance. Retain risks that fit tolerance and pay adequately; modify the others.

Is risk acceptance a valid strategy?

Yes. A firm can accept a risk on purpose, often when the risk is small or removing it costs too much. It may self-insure by setting aside its own funds to cover possible losses.