Risks on projects also need to have two ‘states’. The first state is called the inherent risk rating and can be used to determine what treatment strategy should be employed including ‘do nothing’. The second state is the residual risk rating which is based on an action being taken and it having an effect of reducing the risk, either in full or to a degree, to a level that can be accepted.