Glossary
Risk Control
The process of deciding whether to accept a risk or to reduce or otherwise handle it, and of implementing that decision.
Details
Risk control takes the output of the risk assessment and decides, then implements, whether to reduce the risk to an acceptable level (risk reduction) or to accept it (risk acceptance); it is distinct from the assessment stage that identifies and estimates risk — the ICH Q9(R1) glossary, following ISO Guide 73, defines it as actions implementing risk management decisions. §4.4 requires the effort put into control to be proportionate to the significance of the risk and to address four questions: is the risk above an acceptable level, what can be done to reduce or eliminate it, what is the appropriate balance among benefits, risks, and resources, and are new risks introduced as a result of the controls; it notes that processes such as cost-benefit analysis may be used to determine the optimal level of control. Inspections cite documents closed with no control measures although the risk was assessed as high, no confirmation that control measures were implemented or effective, no record of who accepted the risk and on what basis, and new risks created by the controls left unexamined.
