4. Evaluating the Risk and Control Measures