The motivation of this paper is to develop efficient statistical methods aimed at measuring the performance of business controls. Scorecard and actuarial methods represent the methods mostly employed, in the literature as well as in professional practice. The usage of the two approaches depends on the available data streams. A further problem is that, especially for rare events, a third data stream may be considered: external loss data. It becomes thus necessary to develop a statistical methodology that is able to merge three different data streams in an appropriate way, yet maintaining simplicity of interpretation and predictive power. In the paper we propose a flexible nonparametric approach that can reach this objective.