What it means
A treatment changes the likelihood, impact, ownership, or activity that creates the exposure. The selected response should fit business objectives, legal duties, cost, timing, and available authority.
Why it matters
Clear treatment choices prevent vague remediation plans and make it possible to evaluate whether the response actually changed the risk.
Practical focus
- Choose a response for the defined risk scenario
- Document the expected change in exposure
- Assign actions, resources, deadlines, and owners
- Reassess residual risk after implementation
Common mistakes
- Calling a control purchase a complete treatment plan
- Transferring financial loss while retaining operational risk
- Accepting risk without proper authority
- Leaving accepted risks unmonitored
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: