. . . "risks, including whether controls are adequate to manage the risks," .