If the risk assessment is greater than the risk tolerance, the decision should not be to allow RTP (more precisely, not allow RTP that generates the level of risk assessed in the first step). In a ...