1. A method for evaluating both risks and controls implemented to mitigate the risks associated with a plurality of objects, the method comprising: for each of a plurality of objects: receiving information sufficient to uniquely identify the object; receiving risk input reflective of a risk level associated with each of a plurality of risk categories associated with that object; computing at least one risk score based on said risk input; receiving a plurality of control responses indicative of whether or not each of a plurality of control attributes has been implemented; and computing at least one control score based on said plurality of control responses.