On the three types of risk, you have the treatment tab which based on the “Risk Treatment” selection forces to complete the rest of the form in one or another way.
The documentation shows how that logic works now:
Basically, that hard setting needs to be defined by the user, at “Settings” we need an additional setting call “Treatment Options”
where the user must select for each treatment option (accept, avoid, etc) what options are “MANDATORY” which ones are “OPTIONAL” and which ones are "NOT POSSIBLE:
options are:
- Controls
- Policies
- Risk Exceptions
- Projects
NOTE: policies, standards and procedures must be a single multiple select field instead of three separated fields. see github issue number