Risk managers should discuss the outcomes of risk analysis with the executive team to see whether the results are reasonable, realistic and actionable. If indeed the results of risk analysis are significant, then the executive management with the help from the risk manager may need to:

• 
  
• Revise the assumptions used in the strategy.
  
• Consider sharing some of the risk with third parties by using hedging, outsourcing or insurance mechanisms.
  
• Consider uncertainty by adopting alternative approaches for achieving the same objective or implementing appropriate control measures.
  
• Accept risks and develop a business continuity / disaster recovery plan to minimise the negative impact of risks should they eventuate.
  
• Take the right risks that are within the risk appetite set by the Board or the regulator.
  
• Or, perhaps, change the strategy altogether.
  

Based on the risk analysis outcomes it may be required for the management to review or update the entire strategy or just elements of it. This is one of the reasons why it is highly recommended to perform risk analysis before the strategy is finalised. 

At a later stage the risk manager should work with the internal audit to determine whether the risks identified during the risk analysis are in fact controlled and the agreed risk mitigations are implemented.