A risk is the consequence of a threat. Controls are required to restrict access to objects. Controls are required to ensure objects are accurate and complete. Controls are required to ensure reliability of services. The ability to know who did what, when, where.
Users are responsible and accountable for their actions.
Automatic audit trail monitoring and analysis to detect security breaches. In certain situations, it may be necessary to be able to prove where information came from. This is called non repudiation of origin. A sender may also require proof that the message was received by the intended receiver - non repudiation of receipt. In the absence of a trusted path mechanism, malicious software may impersonate trusted software to the user or may impersonate the user to trusted software.