Risk Treatment Plan: Definition and What to Include
A risk treatment plan (RTP) is the formal document showing, for each identified risk, what you're going to do about it. ISO 27001 Clause 6.1.3 requires one and auditors will ask for it specifically. SOC 2, NIST CSF, and other frameworks don't name it as such, but expect the same substance in the risk register.
The Four Treatment Options
For every risk, you pick one of:
- Mitigate — reduce likelihood or impact via controls. Most common.
- Transfer — shift the risk to a third party (insurance, outsourcing, contractual indemnity).
- Avoid — remove the activity or asset creating the risk.
- Accept — formally sign off on the residual risk because it's within risk appetite.
What a Row Looks Like
A minimum-viable RTP row includes:
| Field | Example |
|---|---|
| Risk ID | R-012 |
| Risk description | Loss of production database due to insufficient backup |
| Inherent rating | High (likelihood 3, impact 5) |
| Treatment option | Mitigate |
| Controls to implement | Daily automated backups to separate AWS account; monthly restore test |
| Residual rating | Low (likelihood 1, impact 5) |
| Owner | Head of Platform |
| Target date | 2026-12-01 |
| Status | In progress |
How to Prioritise
Not every risk gets equal treatment. Standard approach:
- Highest inherent × political sensitivity first. Board-visible, regulator-visible, or customer-visible risks go to the top.
- Highest residual × lowest cost next. Quick wins.
- Everything else by residual rating.
Treating risks strictly by inherent rating is a common anti-pattern — some high-inherent risks already have adequate controls and don't need further treatment.
What Auditors Check
- Every risk above appetite has a treatment option selected.
- Mitigation plans have specific controls named, not "implement security measures".
- Each treatment has an owner with a name and a target date.
- Progress is tracked; dates that have slipped are either justified or escalated.
- Accepted risks are signed off by someone senior enough — not the person maintaining the register.
Living Document, Not Spreadsheet-Of-The-Year
RTPs that are only updated during audit season are easy to spot. Auditors look at the modification history and ask questions when every row was touched in a single week in Q4.