Response decisions and follow-up

Track owner approval separately from response implementation.

Record a response

Open the risk’s active assessment and select the response strategy.
Explain the decision rationale and record the implementation owner, applicable dates, and estimated cost.
Set the review cadence and check the next-review date.
Complete the assessment, then return to the risk’s response decision to check whether owner approval is pending.
After approval, follow the recorded implementation status, owner, and dates; approval alone does not establish completion.

Complete the assessment, then inspect the response and approval state on the risk. Finishing the assessment records the assessor's snapshot; it does not necessarily approve the response.

Proposed mitigation response with implementation owner, planned status, rationale, date, and estimated cost. — Record who will implement the response and why, separately from the owner’s approval. Select the image to view it full size.

Obtain the decision

When the response awaits approval, the authorized owner decision-maker can approve or return it. A returned response needs a reason and revision through a new assessment. An available withdrawal action also retains the earlier submission as history rather than rewriting it.

Check the exact current state before acting, especially when another participant may already have recorded a decision. The completed assessment and later owner decision remain separate records.

Recorded risk response showing an approved decision and planned implementation. — Approved authorizes the plan; Planned means implementation still needs follow-up. Select the image to view it full size.

Follow implementation and review

An approved treatment plan still needs to be carried out. Inspect its implementation status, ownership, and dates, then review whether the residual-risk assumptions still hold. The next-review date is calculated from the completed assessment date and selected cadence.

Use Activity for recorded changes and Assessments for the decision basis over time. The response displays approval and implementation as separate statuses.

Expected outcome

The risk retains the completed assessment and any later owner decision separately. An approved response may still require implementation. A returned response requires its reason and revision through a new assessment; historical decisions are not overwritten.