“Sometimes risks cannot be avoided or transferred, or the costs of doing so would be high. In these circumstances, the organization must retain the risks. Nevertheless, risk prevention and impact mitigation measures and monitoring are usually recommended, at least in outline form. As most businesses in the private sector know, ==hedging or shedding all risks is rarely possible==, and in any case it often costs so much that little or no profit can be made. In these circumstances, companies may become risk takers as an integral part of conducting their business, and reap the associated rewards. In some instances, organizations may wish to consciously retain significant risks, particularly where they have the appropriate expertise to manage them. Risk retention will become an important consideration for those government agencies with current plans or future aspirations to compete with the private sector, those that may be corporatized or privatized, or those that may be judged on commercial criteria, such as profit and return on assets. Some organizations have statutory obligations to retain and manage risk. They will usually take particular care to ==select and implement risk prevention, mitigation and control strategies to ensure the residual risk they must accept is minimized==.” — Project Risk Management Guidelines: Managing Risk in Large Projects and Complex Procurements by Dale F. Cooper, Stephen Grey, et al. https://a.co/2OuBvq4