Ideally, noncompliance is prevented and proactively controlled. Management should take steps to not only minimize the possibility of noncompliance taking place, but also minimize the potential impact of a risk that materializes. Controls should be implemented to prevent noncompliance and to provide indications when suspicious activity takes place. Management should also prepare the organization to appropriately respond to risks when they materialize, including crises and emergencies.