Page 21 - Ghost Digital

which means they are suggestions and not included in any calculations. They can be “recommended”,
which means that the risk committee has not yet approved the expenditure,but they have been vetted.
They can be “planned”; in which case the risk committee has approved the expenditure, but the tasks
associated to putting the controls in place are still not finished. And of course, there are “existing”
controls which are in place as at today. Only these controls contribute to the mitigation effectiveness.

21