According to IIA guidance, many aspects of the related enterprise risk management (ERM) program being informal and undocumented is the strongest indicator of deficiencies in the risk management process.
Informality and lack of documentation can lead to inconsistencies, errors, and omissions in risk management, impairing the organization's ability to effectively identify, assess, and manage risks.References: The IIA's guidance on effective risk management and ERM practices.

An example of an application control specifically involves the software or system used to process information. A two-stage authentication process to access customer information is an application control because it involves the authentication mechanisms within the application software to secure access to sensitive data. This control helps in verifying the identity of users and ensuring that access to critical data is restricted to authorized personnel only.
IT Governance Institute's COBIT Framework.