Link risk controls to evidence and verification

This is regulatory background, not a description of a Complya risk-control workflow. Record controls and their verification in the controlled risk file and supporting evidence.

Risk controls can be inherent design measures, protective measures, information for safety, process controls, training, alarms, or labelling. Prefer design controls over warnings where possible.

For each control, identify the evidence that shows it was implemented and verified. That might be a test report, design review, usability validation, software verification, process validation, or label review.

If a control relies on the user noticing and acting correctly, make that assumption visible. Experts will often scrutinize user-dependent controls more closely.