The assessment of risks produced a list of risks that could require treatment, with their estimation and order of priority.

Treating risks involves the identification of the various options possible, assessment of these options and the preparation and implementation of treatment plans.

Before determining the appropriate treatment actions, it can be useful to review the risk analysis and extend it to obtain the information required for identifying the different treatment options. The design of risk treatment measures should be based on a perfect understanding of the risks concerned; this understanding is obtained from an appropriate level of risk analysis. It is particularly important to identify risk causes so that the risks themselves will be treated and not just their symptoms.

It is not generally profitable, or indeed desirable, to implement all possible risk remediations. It is however necessary to select and implement a combination of the most appropriate of these.