Which of the following is the appropriate next step after management identifies and implements risk responses?