Theoretical and methodological bases for evaluating internal control systems and risk management in modern enterprises. Practical aspects and analysis of the effectiveness of using risk management tools