CGRC - System Compliance - Residual Risk Determination and Documentation