Residual risk score calculation with non-compliant controls

[Trey7]

Where in the configuration does the residual risk calculation take into account any non-compliant controls? My assumption is that the residual risk score should automatically be lowered if there is an associated non-compliant control.

[Trey7]

Thank you! Where can the Calculated Risk Factor & Calculated Risk Score be viewed and can those be configured?