According to ISO 31000, what should decision makers and other stakeholders be aware of after...

The correct answer is C. The nature and extent of the remaining risk. ISO 31000:2018 clearly states that after risk treatment is implemented, organizations must understand and communicate the residual risk—that is, the risk that remains after controls and treatments have been applied.

Decision makers and stakeholders must be aware of the nature (what the risk is) and extent (its level and potential consequences) of the remaining risk to make informed decisions about whether it is acceptable or whether further treatment is required. This awareness supports accountability, governance, and informed risk acceptance decisions.

While understanding the effectiveness and limitations of treatment activities (Option B) is important, ISO 31000 explicitly emphasizes that stakeholders should be informed about what risk remains, not only how treatments performed. Option A is too general and not specific to post-treatment awareness. Option D relates to implementation considerations rather than post-treatment decision-making.

From a PECB ISO 31000 Lead Risk Manager perspective, transparency about residual risk is essential to ensure that risk acceptance is deliberate and aligned with risk appetite and tolerance. Therefore, the correct answer is the nature and extent of the remaining risk.