“We are not sure our controls would catch an error or a misuse.”

Controls may exist on paper but may not be operating in practice.

A walkthrough of key processes such as purchases, sales, payments and inventory.

Controls tested against evidence and a list of improvements in order of risk.