Set Details for a Treatment Plan

As you create or edit a treatment plan, use a Details panel to record the plan's purpose and costs. Also calculate residual risk, which expresses the level of threat remaining after controls are in place to address the risk.

1. Name and optionally describe the plan.
2. Select a Type value:
   • Reduction: The risk would continue to exist, but controls would lessen its effect.
   • Avoid: The plan sets a strategy not to participate in a risky activity. Controls would establish policies to prevent engagement in the activity.
   • Retained: The plan acknowledges that a risk is inevitable. Controls would monitor activities to detect incidences of the risk.
   • Shared: The plan implements a strategy to transfer risk to another party, to cover loss from an uncertain event.
3. Select a Usage value:
   • Choose In Use if the plan is to take immediate effect.
   • Choose Target if the plan may be used to produce results in the future.

   Although you can create any number of plans for a risk, only one can be In Use and only one can be Target. For others, you wouldn't select a Usage value unless you first remove the selection from the current In Use or Target plan. As you calculate residual risk, an In Use plan returns Residual results, and a Target plan returns Target results. Other plans don't return results.

4. Under Treatment Plan Cost, calculate costs:
   • In a Treatment Plan Cost field, enter an estimated cost of implementing the plan itself.
   • Optionally, select the check box labeled Link Treatment Plan Cost to Control Cost. The record of each of the plan's related controls may include a cost value. Selecting the Link check box adds these control-specific values to the plan cost.
   • The remaining two fields are application-calculated: If you select the Link check box, Total Control Cost is the sum of the costs for related controls. Total Treatment Plan Cost is the sum of the treatment plan cost and the total control cost.
5. Under Residual, select a Likelihood value and an Impact value. These express the chance that the risk will be realized, and its severity, once the treatment plan is in effect.
   The values you can select are provided by the Likelihood and Impact models used in inherent analysis, so they're available only if inherent analysis has been performed on the risk. You can't select models directly for residual analysis.

   • If the analysis is qualitative, select labels such as Low or Medium.
   • If the analysis is quantitative, enter numbers that reflect difference from the numbers entered for the inherent analysis.