Risk assessment process is subjective.

Most important factor while evaluating controls is to ensure that the controls: addresses the risk