Which of the following would be MOST helpful when justifying the funding required for a compensating control?