But writing up all the risks and controls into a standard risk-control matrix or risk assessment matrix can take a lot of time, even though they often are similar across different departments and ...