. . . . . . "A decision can be to not respond to the risk or opportunity other than maintaining existing management or control activities." .