Once the significance of the risk and the appropriate controls have been assessed, the level of required action can be ascertained. This ranges from Extreme (immediate action required) to Low (action within a reasonable timeframe).
| Risk Factor | Required Action |
| Extreme | Immediate action needed. Access to the risk should be restricted until the risk can be lowered to an acceptable level. Short term action may be required, to lower the risk level. Medium and long-term plans are to control the risk to as low-risk as reasonably practicable, using the Hierarchy of Controls. |
| High | Action needed quickly (within 1-2 days). The task should not proceed unless the risk is assessed, and control options selected, based on the Hierarchy of Controls. |
| Moderate | Action required this week to eliminate or minimise the risk, using the Hierarchy of Controls. |
| Low | Action required within a reasonable timeframe (2-4 weeks) to eliminate or minimise the risk, using the Hierarchy of Controls. |
Initial Risk Rating
Assessed on first identifying a risk/change to a risk
Residual Risk Rating
Assessed after the controls have been applied