Link Risks/Vendors to Policies or Controls

Add the ability to link risks/vendors to policies/controls, e.g. if ransomware risk has a high inherent risk, after you link it to a control or policy, that risk becomes residual..