# Move from a risk to a treatment plan

Record the scenario, decide treatment and verify implemented controls.

> **Access:** member. Subject to enabled modules and your plan.

## How do you create a risk treatment plan?

A treatment plan connects a risk scenario to a decision, controls, owners and deadlines. In CISAPP, document the risk and its assessment, organize actions, then verify controls before reassessing residual risk. Creating tasks is part of follow-up, not evidence of risk reduction.

## Preparation

Start with a precise fact or scenario, such as a vendor outage affecting a critical activity. Prepare context, ownership and assessment information.

## Journey

1. Check whether the risk already exists under **Registers → Risks**.
2. Otherwise, [create it](https://docs.cisapp.eu/en/risks/register) with its scenario and affected entities.
3. Assess likelihood and impact using the organization’s methodology.
4. Decide a treatment strategy and record its justification.
5. Add useful controls, owners and deadlines.
6. Use an [action plan](https://docs.cisapp.eu/en/collaboration/projects) if work involves multiple actions.
7. Update controls as work progresses and verify evidence.
8. Reassess residual risk, then use the appropriate lifecycle action.

![Risk register for review](https://docs.cisapp.eu/images/en/risks.webp)

*The register helps find risks before preparing decisions. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/risks.webp)*

## If a gap must be tolerated temporarily

An administrator can prepare an [exemption](https://docs.cisapp.eu/en/risks/exemptions) with justification, compensating controls and a deadline. An exemption does not replace risk treatment.

## Success criteria

The scenario, decision, actions and residual level are reviewable. Do not close a risk solely because an action was created: implementation and verification should support the decision.

## Expected outcome

The risk has a treatment approach, owners and tracking that can be reviewed at the next checkpoint.

## Common questions

### What is the difference between a treatment plan and an action plan?

Treatment explains how the risk is addressed and how its level will be reviewed. An [action plan](https://docs.cisapp.eu/en/collaboration/projects) organizes actions and their completion. Link actions to the risk to preserve the decision context.

### When should you reassess residual risk?

Reassess it when you have information about control completion and effectiveness. Apply your organization’s method and retain evidence supporting the new level. A passed deadline does not demonstrate that a control works.

### Does an exemption replace the treatment plan?

No. An [exemption](https://docs.cisapp.eu/en/risks/exemptions) sets conditions for a temporary deviation, including justification and a deadline. Treatment and control follow-up remain necessary; preparing an exemption requires organization-administrator access.

Explore more [questions about vendors, risk and compliance](https://docs.cisapp.eu/en/help/common-questions).