Lessons learned, Review effectiveness of existing security controls, Risk Management