The weakest risk programs are not the ones with no documentation - they are the ones that mistake documentation for defense, leaving blind spots in scope, assumptions, and business impact.