In addition, the agency's risk assessment process (as called for in the OMB guidance14) should disclose the risks considered that would prevent the system from successfully complying with the criteria selected by the agency.
The risk assessment process helps with regulating risks.