Stichworte: internal control * point risk assessment segregation