The groups focused their efforts on increasing everyone 's understanding of the risks associated with the organization 's information and the related policies and controls in place to mitigate those risks .
It was decided that the groups could make no impact on awareness of risks , so , instead , they focused on mitigating risks directly .