Who is accountable for risk treatment?