Staying above the cloud on risks and controls