Building the Ideal GRC Tool: A Risk-Based Approach