Describe the internal control principle of “Risk Assessment”