Typically, this means using another company to take on a business process that you do not wish to carry out in-house, or are unable to do yourself. There are benefits in terms of reducing the probability and impact of downsides and also in-house effort in managing the risk, but there will be a cost - people will want paying for taking on risks.
Risks can be transferred in different ways:
- formally: on a contractual basis (e.g. IT service agreement), or through some other written agreement
- informally: through discussions and meetings, on a basis of trust
- tacitly: through assumption, perhaps based on precedent or simply beliefs.
Tacit risk transfer is generally not beneficial - it often represents a situation where one party has wrongly assumed that the other one will take an action or respond to a situation. To prevent problems like this, you need share all information on the risk with the potential transferee: its nature, probability and likely impact (on both parties); what you will pay them to take it on, why you want to transfer it and so on.
Payment for taking on risks will be more realistic when there is frank and realistic discussion of probabilities, impacts and costs. Lack of communication may prompt the party taking on the risk to overcharge in order to cover themselves against the unexpected, or factors tha have not been clarified.