They must maintain the risks within the defined tolerance levels, implement and enforce effective prevention and mitigation controls, ensure adequate definition and execution of action plans, and establish corrective actions to continuously improve risk management .