# Track risk treatment

Choose a strategy, track controls and review residual risk.

> **Access:** member. **Beta** feature, subject to enabled modules and your plan.

## Open the risk

Open the risk from **Registers → Risks**. Check its scenario, scope, owner and assessment before deciding treatment.

## Organize treatment

1. Choose an offered strategy: reduce, accept, transfer or avoid the risk.
2. Record the decision and treatment deadline.
3. Add the necessary controls. A control can link to a compliance requirement or be described specifically for the risk.
4. Assign an owner and deadline where offered.
5. Update control status as work progresses: planned, in progress, implemented, verified or not applicable.
6. Reassess residual risk based on controls actually implemented.

## Understand statuses

A risk can be draft, identified, assessed, treated, accepted, closed or needing review. Use available record actions to move through its lifecycle. A control marked implemented is not necessarily verified yet.

## Expected outcome

An authorized person can find the decision, planned actions and information supporting the residual level. Status should reflect the actual situation.

## Points to watch

Do not lower residual risk solely because an action is planned. Check implementation evidence. If an action is unavailable, check permissions and the current risk status.

See also [The treatment journey](https://docs.cisapp.eu/en/guides/treat-risk) and [Exemptions](https://docs.cisapp.eu/en/risks/exemptions).