Why This Matters: Depending on the risk level within the organization, the type, extent and depth of treatment will change. Tailoring a enterprise treatment plan for a systemic risk is different that a point or task specific treatment for a product defect.
Project Question: In terms of your project, identify enterprise, program/project, and product/transactional controls? What risks are these controls mitigating?