[oneeyedpigeon]

The trouble is, temporary compensating controls have a history of becoming permanent once in place, so you need to be absolutely sure you want those controls forever.

[cavilatrest]

That's a good point, and while I hesitate to think about this terms of pure risk management, the same stuff happens in my company.