A series of steps that must be taken to address an identified risk that is outside of appetite. For example, this can include mitigation of the risk, implementation of controls, or transfer of the risk.