An internal control system available to a firm according to Grieves (1998)
consists of: management oversight and the control culture; risk recognition and
assessment; control of activities and segregation of duties; information and
communication and monitoring activities and correcting deficiencies