risk response strategies: mitigate, accept, avoid, or transfer