control and risk self assessment