Within each process,
the internal audit personnel assess gross risk (threats or impediments to the accomplishment of corporate or process objectives),
the strength of relevant controls and of management's response to the identified risks,
and residual risk (a re-evaluation of risk in light of controls and management's response)