decision trees is already used in Quantitative risk analysis, and as you suggested during Control Risks we will have to go through the outputs from the Quantitative Risk analysis which will require modification and updates based on the current situation. So, decision trees may be implicitly used during Control risks process.

Since Decision tree deals with making decisions, Should it be part of control risk process, which deals with implementation of risk response?