What is step three of the the five composite risk management?

Step 3:

Develop controls and make risk decisions. Develop control measures that

eliminate the hazard or reduce its risk. As control measures are developed, risks

are re-evaluated until the residual risk is at a level where the benefits outweigh

the cost. The appropriate decision authority then makes the decision.