It includes decision making to reduce and/or accept risks. The purpose of it is to reduce the risk to an acceptable level. The amount of effort used for it should be proportional to the significance of the risk.