When you create a Policy Exception and choose the Source Type as Control Objective, Issue, or Control, you need to list the impacted controls in the related list. ServiceNow then checks if any of those controls are linked to a Risk. If they are, that Risk will automatically appear in the Risk related list on the exception form.
Now, if that Risk is tied to multiple controls, and you only selected some of them as impacted controls, the system will place the remaining controls in the Mitigating Controls related list.
For example, if a Risk is connected to three controls and you mark only one as impacted, the other two automatically show up under Mitigating Controls.
