Make Control Decisions, involves two major dimensions. The first is the selection of the risk controls to actually use from among those developed in the third step of operational risk management. The second is the decision whether or not to accept the res