“What if the risk is out of the CRO’s management/control, though still having probability & magnitude. As the budget assigned to sites for example?”
ICH GCP Ref: 5.0 ; 5.0.1 – 5.0.7 ; 5.2.2
This is important from the CROs perspective. I think documenting the risk and agreeing the control mechanisms with the sponsor is critical in this scenario, ultimately the controls will be agreed to by the sponsor, if they do not agree to the controls, you could argue this increases the risk, but documenting the risk and the likelihood and magnitude should help the sponsor understand the rationale behind the reason for the recommended controls.