Risk Controls
If you agree with the EU approach that all risks must be reduced regardless of the initial risk score, we have to consider risk controls for each risk.
If you don’t market in the EU or anywhere that requires the “as far as possible” (AFAP) approach and allows the “as low as reasonably practicable” (ALARP) approach, AND you don’t agree with the AFAP approach, then you will likely conclude that anything with an initial risk score in the “green” as shown in our standard severity/probability table below need no further risk control.
The conservative approach, of course, is to reduce all risks to the greatest extent possible.
This covers you if you do ever plan to go into the EU.
(Bolting on additional controls to reduce to the greatest extent possible after you’ve taken the ALARP approach is painful!)