Standard practice in the Risk and Control ("R&C") Profession generally does not include financial analysis. This is unwise given the scale of investment involved. An approach to applying financial analysis to realm or risk and control will be outlined with an emphasis on information technology controls. A definition of R&C from an economic standpoint and a framework for the financial analysis of R&C will be proposed that is both simple and robust. The implications of financial analysis for R&C will be discussed, including the cost drivers for control design and operation and the resulting benefit in terms of the reduction in residual risk exposure that results from the implementation and operating effectiveness of controls. Last, some thoughts and guidelines on methods to effect an economically efficient control environment for organizations based on the financial analysis framework proposed, will be outlined.