. . "When Management chooses to mitigate a risk, they will do so by implementing one or more of three different types of controls." . .