Adding Controls to Risk Assessment when Assesing Control Environment
I understand that controls cannot be added to a risk assessment when the RAM is configured to assess risk based on the existing control environment. However, I would like to better understand the rationale behind this limitation. Ideally, we would wa...