risk record 12.6 risk response plan preparation and