From understanding comes action. Your risk management efforts up to this point will have yielded a list of concerns; a measure of how much these concerns could affect objectives; and a decision of whether, when, and how to address them. The last step in the risk management process is to act upon this information to make sure your organization takes full advantage of opportunities without exposing itself to unacceptable levels of risk. Drawing from industry success stories, lessons learned, and the phase of the ISO 31000 risk management standard called "Treat the Risk," this report explains how to create and execute a response plan for risks that you have evaluated to be outside of your appetite.