risk control/management 基本上是纸上谈兵和马后炮