# Risk treatment plan

The ISO 27001 plan for dealing with assessed risks: which controls or actions, who owns each, and by when, approved by the risk owners.

Source: https://sted.digital/docs/glossary/risk-treatment-plan · Last reviewed 17 October 2026 · Strand Glossary

A risk treatment plan says how you will deal with the risks you decided to treat: which controls or actions, who owns each one, by when, and how you will know it is done. ISO 27001 requires one, and your risk owners approve it and accept whatever risk is left afterwards.

## Where the term appears

ISO 27001:2022 6.1.3 e) asks you to formulate the plan, and ISO 27001:2022 6.1.3 f) asks the risk owners to approve it and to accept the residual risks. ISO 27001:2022 8.3 then asks you to carry it out and keep the results as documented information. The standard sets no format: a few extra columns in the risk register often do the job. ISO 42001:2023 6.1.3 asks for the same treatment and approval for AI risks. The [risk assessment and treatment page](/docs/standards/iso-27001/risk-assessment-and-treatment) covers the whole of clause 6.1.

### The plan and the SoA

The two are companions. The Statement of Applicability says which controls apply and whether each is implemented; the plan says how the missing ones will arrive, through whom and by when. An auditor checks that the actions match the controls not yet implemented and the risks above your acceptance criteria, and that the approval is dated and comes from the risk owners, not only the security lead.

## How Sted uses it

For ISO 27001 risk work Sted's knowledge base carries the Risk Management Procedure (PRC-RMP) with its Operating Risk Assessment Record (REC-ORAR) and Operating Opportunity Assessment Record (REC-OORA), and for planned changes the Change Management Policy (POL-CHG) with its Change Record (REC-CR).
Records are part of the Full Management System plan.
The Risks and opportunities register holds each risk's likelihood and impact before and after controls, the controls in place, whether it is above your risk appetite, its treatment plan, an owner and a last-reviewed date, and lists its inherent and residual levels.

## Related terms

- [Statement of Applicability](/docs/glossary/statement-of-applicability): the companion document listing which controls apply.
- [Risk register](/docs/glossary/risk-register): where the risks being treated are recorded.
- [Residual risk](/docs/glossary/residual-risk): what the risk owners accept once the plan is done.
- [Control](/docs/glossary/control): what most plan actions put in place.
- [How to run a risk assessment](/docs/guides/risk-assessment): the assessment the plan follows.