Risk management standards and regulations are evolving and becoming increasingly stringent. This paper describes a methodology for evaluating the effectiveness of risk control measures that draws from existing work on system resilience. System resilience principles are reduced to a set of questions that can be easily understood to ensure adequate application of the principles. This paper describes a method for determining when appropriate risk reduction has been achieved and a method that can be applied consistently across projects, companies, and industries to enhance the effectiveness and efficiency of risk mitigation efforts.