there is an annoynig, well intended feature, that when changes are made on a field other fields which are related are automatically calculated.
internal controls and policies are related, so changing controls will update the policy field with whatever policies these controls have associated. i think that is what is going on. to fix this, you need to manually update the policy field.
same happens with assets and threats and vulnerabilities (Feature - risks threat tags and vulnerabilities get populated with asset changes) … this behaviour is removed (or rather updated) on the new user interface (Feature - New User Interface for eramba - #2 by kisero)