The risk & control matrix

The RCM as the program’s spine — risk statements that are actually risks, the five elements of a control description, and mapping to assertions.