# Clause 6.1.2: Addressing risks and opportunities

Plan the actions that will address those risks and opportunities, and plan how each action will be integrated into and implemented within BCMS processes and how its effectiveness will subsequently be evaluated.

Cloud: Treatment for provider risk is usually contractual, architectural or procedural, and each has a cost. Record which treatment was chosen, what it reduces and what it leaves exposed, so the board is deciding with the same facts later.

Evidence: Action plan naming owner, target date and the BCMS process the action lands in; Updated BCMS procedures, plans or BIA records showing where each planned action was built in; Effectiveness evaluation carried out through performance evaluation.

Test: For each treatment, state the risk it reduces and the exposure that remains.

Citation: ISO 22301:2019, clause 6.1.2. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.