2. Risk factors and control framework