These include the identification of fatal risks and associated critical controls and standards, auditing, reporting on leading and lagging indicators, technological tools, and ongoing communications and training.