https://www.ifsqn.com/forum/index.php/topic/17009-brc-risk-assessments-do-they-need-to-be-documented/