Example
A review identifies that sensitive employee records are accessible to too many users and assigns an owner to restrict access and review permissions.
What to keep in mind
Assess actual exposure and consequences rather than listing generic risks. Include risks to employees as well as business costs, and check whether proposed controls address the identified cause.