What guidelines do you use – or you would advise be used – to ensure that the risk response strategy selected is effective for managing that risk? What insights would you offer to know if the response is both necessary and sufficient?
(need two three reference)
