Within each process, the internal audit personnel assess gross risk (threats or impediments to the accomplishment of corporate or process objectives), the strength of relevant controls and of controls and management's response to the identified risks, (a re-evaluation of risk in light of controls and management's response).