Yes, I am an over-thinker, however for auditing this is a good thing, because I would make sure that I have considered the likelihood and impact of risks thoroughly before recommending an action to improve processes/controls.