Mechanisms exist to remediate risks to an acceptable level.
Does the organization remediate risks to an acceptable level?