https://www.servicenow.com/community/grc-blog/new-now-on-now-blog-two-truths-and-a-lie-about-risk-management/ba-p/2274777