A tool to assess risks associated with software applications, and controls implemented to mitigate these risks, includes a first software component configured to gather information about the risks and controls, and a second software component configured to display the gathered information. The first software component includes a self-assessment tool which is invoked by a user to enter information reflective of risk levels over a number of risk categories. These risk levels are used to calculate a risk score associated with a particular application. The user also enters information as to whether or not a number of specific control attributes have been implemented, and this information is used to calculate a control score.