How the generator decides
Controls are recorded as what is actually in place. Anything recommended for the substance that you leave unticked goes on the further action list, so the gap is on paper. The risk rating is yours: the generator suggests a starting severity from the hazard classification, and you set the likelihood from how the work is actually done.