In an extreme case, if the expected monetary value or other measure of expected impact exceeds the organization's risk tolerance, then the project might be cancelled. Scope reduction might also help to reduce the severity of the risk.
Otherwise, you go with the second best option or a series of complementary responses and monitor and track the residual risk accordingly.