Controls don’t eliminate risk; they shift how you measure and manage it. And let’s be honest: compensating controls don’t reduce the total volume of work; they shift where the work happens.