where do they belong?

plan, do , check, act:

1: Risk treatment plan implementation

2: risk assessment

3:continual improvement of infosec risk management process

4: Accept assessed risks