Statistics for Technology governance risk and control