Sometimes risk appetite statements may be developed. •  Risk planning and mitigation actions are identified and established to achieve the desired residual risk level. Preventative and remedial actions should be considered. Risks may be prevented or rendered unlikely through various control measures, and impacts alleviated through appropriate plans and actions.
•  Risk management is assigned – risks and their management require ownership within the business. When accountability is unclear, risks are less likely to be managed and more likely to materialise. Ownership should be assigned to the role or person who is best placed to manage the risk, acknowledging that impacts may be widespread.