The reason risk assessments are performed is to pinpoint the areas that need improvement and of course improve them by remediation...

Yes... Answering the control questions is the most important part of the risk assessment.  But...