"If one just does the tick the box exercise, then the former case is worse as it gives a false assurance that the risk has been treated, whereas the latter can be picked up by the checker that things have not been implemented. If the system includes…"