Standard risk assessment methodology does consider inherent risk (the risk before any controls are in place), the strength of controls, and the residual risk with controls. Residual risk above low is then considered to see if controls should be strengthened, if risk can be reduced in some other manner (such as insurance, or even shutting down a high risk product), etc.