The reason risk assessments are performed is to pinpoint the areas that need improvement and of course improve them by remediation...

  Let's face it.  Cybersecurity attacks will always be a threat to your organization....

Yes... Answering the control questions is the most important part of the risk assessment.  But...