Compensating control

Sometimes the obvious protection is not possible. The machine is too old, the supplier will not support it, the change would stop the business running. A compensating control is a different measure that covers the same risk another way.

It is a legitimate answer, not a dodge, but it is nearly always less complete than the thing it replaces. The honest version names what is missing and what the substitute does not cover. The dishonest version writes down a compensating control because a form demanded one, and nobody ever checks whether it genuinely addresses the same problem.