A risk profile element is created and associated with a control element within a risk hierarchy associated with an organization. A risk attribute is updated automatically within the risk profile element in response to an event associated with the control element. The updated risk attribute is processed to evaluate risk associated with the control element.