5.5.8.6 Comparison of estimated vs. actual risk mitigation effort and impact