Business risk management: Effectiveness of preventive controls