Gap analysis, Review effectiveness of existing security controls, Risk Management