Risk & Control: what should financial institutions be mindful of?