Abstract: A method is provided for assessing control risk in a model-based reasoning system used for analyzing financial accounting systems by decomposing and quantifying the risk factors in the model so that the risk factors can be used to determine areas in the accounting system where sufficient control is lacking and to determine which controls are key and thus should be subject to detailed testing. Factors quantified are failure impact risk, failure coverage risk, allowable risk, control detection risk, control strength, control defeat factor, attenuation factor, and control contribution. The present invention is used to enhance a hierarchical flow chart generating system, such as the Comet system, by providing risk analysis operative on a particular class of hierarchically structured flow charts.