The first section of a qualitative RA attempts to prioritize risk. The second section of a qualitative RA evaluates the effectiveness of controls. True False