While the risk-and-control profession has grown in sophistication, some aspects of current practice are inconsistent with sound management decision-making and business analysis. Foremost among these is the financial evaluation of control. Simply stated, when it comes to the risk-and-control discipline, methods of financial evaluation that are routinely used for other aspects of an organization's operations are either not used or used to a much lesser extent. Many organizations, moreover, view the effort to implement an effective control environment to be a "cost of doing business" that does not warrant the degree of analysis that is generally applied to other areas of the organization. The objective of this book is to illustrate that, despite the unique characteristics of risk and control, the discipline should merit the same degree of financial/economic analysis as is applied to other topics of comparable cost, scale, and complexity. After establishing this point, this text outlines a practical framework for evaluating risk and control from a financial standpoint. The remaining text is devoted to outlining, in a step-by-step manner, the practical methods and implications for applying the framework to a wide range of risk-and-control decision-making contexts, thus allowing the reader to understand (at least "directionally") the guidelines and considerations for applying financial analysis to reduce costs and increase the efficiency and effectiveness of an organization's control environment. This brief, authoritative text is truly a 'must-have' addition to every internal audit library.