Mitigating risks, or lessening their adverse impacts, is at the heart of the effective management of risk. Unfortunately in business activities risk mitigation is sometimes undertaken only at a rather superficial level. If more attention were paid to it, fewer business activities would end in disaster. It is not sufficient just to 'take a margin' for risk, since this results in little risk mitigation being done.

If implemented correctly a successful risk mitigation strategy should reduce any adverse variations in the financial returns from a project. However, risk mitigation itself, because it involves direct costs like increased capital expenditure or the payment of insurance premiums, might reduce the average overall financial returns from a project; this is often a perfectly acceptable outcome, given the risk aversion of many investors and lenders.

Risk mitigation should cover all phases of a project from inception to close-down.

There are four main ways in which risks can be dealt with within the context of a risk management strategy. Risks can be

• reduced or eliminated
• transferred
• avoided
• absorbed or pooled.

There is also the question of whether it is worth carrying out research to reduce uncertainty.