Why This Matters: A simple approach is to add more controls if the risks are in the red zone of the heat map. If they are in the yellow zone, then see if the risk is acceptable. If the risk is in the green zone, stop.
Project Question: If residual risk is in the yellow zone, how would you resolve this?