Treat the risk and verify the action result

Continue the Acme case

The approved assessment supports a response to single-supplier dependency. Acme proposes a documented backup supplier and an earlier delivery checkpoint for the next project. The original $6,000 machine remains a historical purchase; this action does not create another order or change October's books.

Role and prerequisites

The risk owner prepares the response and action plan. An assigned action owner performs the work; an independent eligible reviewer accepts its result. Head of Risk or another configured authority decides acceptance or escalation under Acme's approved rules. A task assignment alone is not unrestricted risk authority.

Plan, execute and accept

1. Choose the supported response and document its expected effect, owner, deadline and verification criterion. “Find an alternative supplier” is insufficient; require an evidenced viable alternative and a reviewed delivery checkpoint.
2. Submit the response and action plan for the required decision. Preserve the approved plan separately from later execution versions.
3. As action owner, open the assigned Core work, record what was completed and attach the actual evaluation and checkpoint evidence. Save once and reopen the execution result.
4. The independent reviewer checks the criterion. If evidence is incomplete, return with a reason. The owner supplies a new execution revision; the approved plan and earlier evidence remain.
5. After acceptance, follow the resulting risk review. The risk owner prepares the reassessment; the required independent approval decides the new view. Accepted action evidence does not justify silently lowering the risk.

Verify the saved result

The plan, execution, return/correction if needed, accepted result and subsequent assessment remain linked. The action owner cannot accept their own result; retry does not create duplicate revisions. A cancelled action retains its reason and does not appear completed.

Next, investigate a conflict-of-interest disclosure involving the same supplier. A risk response is separate from the compliance decision.