Recognize the conceptual frameworks that exists for evaluating risk controls and be able to formulate a cost benefit analysis?