in which step of the general risk management model do you determine which controls to put in place to mitigate the risks?