An enterprise risk management (ERM) system performs real-time self-diagnosis of functional code of the ERM system that controls the policy enforcement actions within the ERM system. Real-time execution effectiveness of at least one control instance of the ERM system at operationally mitigating real-time authentication services security risk(s) and user access compliance risk(s) is determined. At least one code modification to a control class definition is identified that adjusts one or more real-time operational control aspects of the at least one control instance and that improves real-time execution effectiveness and operational capabilities of a new control instance instantiated from an updated control class definition at operationally mitigating the respective real-time authentication services security risk(s) and user access compliance risk(s) within the ERM system.