Which of the following risk assessment tools would best facilitate the matching of controls to risks?