The IT Scoping Problem Internal Control Sytems (ICS) are all about controlling risk. Enterprise Risk Management bases its decisions how to handle a certain risk basically on risk exposure, which is the product of the probability of an incident occurring …