User
What is the recommended base for controls? Is more better as in comprehensively covered or the minimum to reduce the resdiual risk?
Experta
Risk management is also about reducing risks in a cost-effective way, so you should consider using the minimum quantity of controls to reduce risks to an acceptable level.