Treatment plans and effectiveness

A treatment plan turns a risk response into work someone actually does. RiskCurb gives every treatment an owner, a due date, a status, and a place in the review cycle, so follow-up survives busy weeks and staff changes.

Building a treatment plan

From the risk, create the treatments that would reduce exposure. For each one:

1. Name the action concretely, so completion is verifiable.
2. Assign a single owner and a due date.
3. Link the treatment to the risk it treats.

Concreteness is the test. "Improve vendor management" is a wish. "Complete vendor risk assessments for the top ten suppliers by Q3" is a treatment.

Tracking progress

Each treatment carries a status, updated by its owner. Overdue items surface automatically in the operating and reporting views, which means the follow-up conversation starts from status, not from memory. Escalation is visible to leadership without anyone compiling a chase list.

Effectiveness and residual risk

When a treatment completes, the risk owner judges its effect and updates the risk's residual rating. This is the loop that keeps the register truthful:

• Treatment completes, with evidence attached.
• Owner reviews the outcome against the risk statement.
• Residual rating is updated to reflect the exposure that remains.

If the residual rating does not move after the work is done, say so. Some treatments hold exposure steady rather than reduce it, and an honest register records that.

Closing the loop

Completed work updates the related risk, and the risk's history shows what changed and when. That traceable record is what audit committees and councils are actually asking for when they ask whether the risk function works.