These include the identification of high-potential risks and associated critical controls, as well as standards, auditing, reporting on leading and lagging indicators, technological tools, and ongoing communications and training.