The controls are you go to jail if you get caught. At least this is what one is told in the mandatory ITAR compliance trainings. That seems to be how the law works for most crimes.
It's an incentive but it's certainly not a control. Controls stop something from happening, they don't respond to it after the fact. Controls would be things like security checkpoints, network monitoring, random searches, that sort of thing.
"You will go to jail if you kill someone" isn't a control against murder.
"You will go to jail if you kill someone" isn't a control against murder.