Risk control has no rules