What is a control in risk management?