The fifth step in the Microsoft Operations Framework (MOF) Risk Management Discipline is controlling risk. During this step, individuals carry out activities related to contingency plans because triggers have been reached. Corrective actions are initiated based on risk tracking information.

The MOF Risk Management Discipline relies on existing standard processes and infrastructure to:

• Monitor risk action plans.
  
• Correct for variations from plans.
  
• Respond to triggering events.
  

The results and lessons learned from implementation of contingency plans are then incorporated into a contingency plan status and outcome report so that the information becomes part of the operations risk knowledge base. It is important to capture as much information as possible about problems that occur or about a contingency plan when it is invoked to determine the efficacy of such a plan or strategy for risk control.

At first this step may not seem necessary, and the distinction between it and the tracking step may be unclear. In practice, the need to act is often detected by a tool or by people who don't have the required responsibility, authority, or expertise to react on their own. The controlling risk step ensures that the right people act at the right time.

The best practices described below will be beneficial during the risk controlling step.

The risk controlling step relies heavily on effective communication, both to receive notification that parts of risks and plans have changed, and to ensure that the right people take action at the right time. The risk controlling step can't be effective unless communication within IT is also effective.