In risk management, what is the purpose of implementing controls?

• A. To identify hazards.
• B. To transfer all risk to higher command.
• C. To reduce likelihood and/or consequence of hazards, thereby lowering residual risk.
• D. To eliminate all risk entirely regardless of cost.

Answer: (C)

The key idea is that controls in risk management are there to make hazards less likely to cause harm or to lessen the harm if it occurs, so the remaining risk (residual risk) is brought down to an acceptable level. After hazards are identified and risks assessed, controls are chosen to reduce either the likelihood, the consequences, or both, using a hierarchy (engineering controls to remove or reduce the hazard, administrative controls to change how people work, and PPE as a last line of defense). This is different from simply identifying hazards, which happens earlier in the process, or from trying to transfer all risk to someone else or eliminate every risk, which isn’t feasible or cost-effective. The aim is to lower risk to an acceptable level, not to remove it entirely.