As risks are addressed and controls are changed , they should occasionally be revisited to determine where the risks have decreased and where new areas of risk may exist .
Controls should never be revisited .