Abstract: A method and system for selecting an optimal set of management and risk controls for a given set of risks within a variable control budget. Specifically, optimization according to the present invention is defined using a method and system to calculate the greatest reduction in an organization's risk exposure with the minimum investment in cost and time as measured by the economic value added of the risk system change. Risk control models and management risk control models are client customized into a risk control system specifically addressing a clients applicable risks and their associated exposures. An operator is able to determine which risk control system maximizes available resources while also reducing an organization's total risk exposure.