To ensure the correct profiles and permissions for an API integration between Salesforce and a risk control system, the consultant should do the following steps:

Create a dedicatedIntegration User that will be used to authenticate and authorize the API calls between Salesforce and the risk control system. The Integration User should have a unique username, password, and security token that are not shared with other users or systems.The Integration User should also have the minimum permissions and access settings required to perform the integration tasks.

Create a new custom profile and ensure API Only is selected. The API Only option restricts the user from logging in to the Salesforce user interface, but allows the user to access the Salesforce API. The custom profile should also have the appropriate object permissions, field-level security, record types, page layouts, and other settings that are relevant for the integration. The custom profile should be assigned to the Integration User.