Which is recorded in the risk response plan during the ‘plan’ step?