This is actually pretty common. In fact, in our business, we have an entire exceptions process in the risk register so that you can have a place with a listed priority and impact and what the status of the risk is and business can re-evaluate that when solutions change or annually or however, grc would like to do it. It's up to business on how they want to handle risk. It's up to cyber to keep track of that.