A clear, proportionate review of the controls your business depends on — and practical advice on what to fix first.