In many cases, risks are identified before appropriate controls are in place. When a risk falls outside of our risk appetite, a control or mitigation strategy is usually defined on the spot. It would really enhance the flow of risk sessions if the tool allowed users to add a new control immediately after determining the inherent risk score—rather than having to circle back later. Then after, you determine the residual risk score.

Additionally, it would be a great improvement if we could add controls directly from the sidebar, instead of navigating through the settings (which currently takes about four clicks just to add one control). Or directly via the framework page.