During what step of the risk management process do companies assess their highest ranked risks in order to develop a plan using risk controls?

During what step of the risk management process do companies assess their highest ranked risks in order to develop a plan using risk controls?