Controls are a key part of NAIF’s RMF and aim to minimise the chance of a risk event materialising. Mitigating controls are documented for each key enterprise risk and are regularly assessed for effectiveness.