You have to answer the question set. So if there are two requirements “… evaluate business risks …” and “… evaluate ROMM” – they can be evaluated separately.
Not all business risks will have a ROMM (so cannot be related). For example, competition is a business risk but that revenue may fall is a fact not misstatement.