When risk exceeds tolerance, the appropriate action is to engage the risk treatment process. This involves evaluating and implementing appropriate responses such as mitigation, transfer, or acceptance.