If a risk is simply controlled by a policy, a training course and a monitoring test then it is primarily controlled by and relies on people. Sometimes that is appropriate but sometimes it is not strong enough. This infographic learns from another industry - safety - where understanding a control's strength is a matter of life of death. It applies the safety professions' hierarchy of controls to compliance: five tiers from strongest to weakest, who owns each, compliance's part, and what each relies on.