Describe how risk treatment is determined

Risk treatment options should be selected based on the outcome of the risk assessment, the expected cost for implementing and benefiting from these options. The risk tolerance and appetite of an organization will have a strong impact on the risk treatment plans, as some may choose to retain more significant risks than others if the potential positive outcomes are worth the balance. Risks are ranked based on likelihood and consequence (each rated from 1-5) and from this the risk priority is determined.