An existing process, policy, device, practice or other action that acts to minimize negative risk or enhance positive opportunities. Note: The word 'control' may also be applied to a process designed to provide reasonable assurance regarding the achievement of objectives