Opening any risk in your Risk Register walks you through the same assessment: score it, decide how you're treating it, then score it again.
Inherent risk: before treatment
Inherent Risk is your starting point — score the risk as it exists today, with none of your planned treatment applied yet:
Both Likelihood and Impact are scored 1–5. The risk score shown in the register table is simply Likelihood × Impact — a 3 Likelihood and 2 Impact gives a score of 6, matching what you'll see in the list.
Treatment Plan
Pick how you're actually addressing the risk:
Mitigate — identify controls or tasks that reduce the risk score. The most common choice, and the only one where you're actively changing something to make the risk smaller.
Transfer — move the risk outside your organization's own responsibility, e.g. buying cyber liability insurance.
Avoid — stop doing the activity that causes the risk in the first place.
Accept — decide to live with the risk as-is and take no further action. A legitimate choice for low-severity risks where treatment would cost more than the risk itself.
Treatment Details is a required free-text field regardless of which type you pick — write down specifically what you're doing (or, for Accept, why you've decided not to act).
Residual risk: after treatment
Score the risk again, this time assuming your treatment plan is actually in place:
Same Likelihood × Impact model, same 1–5 scales — just applied to the risk after your treatment takes effect. A well-chosen Mitigate treatment should usually pull this score down; for Accept, residual often ends up the same as inherent, since nothing's actually changing.
Comparing inherent vs. residual across your whole register is exactly what the Risk Matrix (see Creating and Managing Your Risk Register) visualizes — plotting where your risks sit before and after treatment side by side.