Implement compensating controls until the preferred action can be completed, because it helps to reduce the residual risk to an acceptable level, while allowing the preferred action to be delayed or postponed. A risk treatment plan is a document that describes the actions and resources required to implement the chosen risk response strategy for a specific risk. A risk response strategy is a course of action that is selected to address a risk, such as avoid, transfer, mitigate, or accept. A compensating control is a control that provides an alternative or additional measure of protection or assurance, when the primary or preferred control is not feasible or effective. Implementing compensating controls is the best approach, as it helps to maintain the risk management process and objectives, and to avoid or minimize the negative consequences of the delay or postponement of the preferred action.
Developing additional key risk indicators (KRIs), replacing the action owner with a more experienced individual, and changing the risk response strategy of the relevant risk to risk avoidance are all possible approaches when a risk treatment plan cannot be completed on time, but they are not the best approach, as they may not address the residual risk level, and they may introduce new risks or issues.