What can be used for bank-internal risk control, as well as for regulatory external control?