Workshop 5
Workshop 5 plans the treatment measures for the risks identified in Workshop 4, tracks their implementation and computes the residual risks.
Sub-steps of the workshop
| Step | Page | Content |
|---|---|---|
| 5.1 | Risk summary | Consolidated view of all identified risks, positioned on the matrix |
| 5.2 | Treatment strategy | Choice of treatment (reduce / transfer / refuse / accept) for each risk |
| 5.3 | PACD | Detailed treatment plan: selection and scheduling of security measures |
| 5.4 | Residual risks | Comparison of gross risk / residual risk after measures |
| 5.5 | Risk monitoring framework | Tracking the status of risks and measures over time |
The detail of pages 5.2, 5.3 and 5.4 is described in Treatment strategy, PACD and Residual risks.
Recommended approach
- Review the risk summary (5.1), inherited from Workshop 4.
- Decide on the treatment strategy (5.2) for each risk: reduce, transfer, refuse or accept.
- Detail the treatment plan (5.3 — PACD): concrete measures, owners, deadlines.
- Check the impact of the measures on the residual risks (5.4) — the likelihood re-rated after treatment.
- Track progress in the monitoring framework (5.5).
Formal acceptance
A risk treated by acceptance must be formally validated by the project or organisation manager — document this decision, it is expected in the final report.
Going further
See Treatment strategy, PACD, Residual risks and the EBIOS RM Report for the final export.