within each process, the internal audit personal assess gross risk (threats or impediments to the accomplishment of corporate or process objective), the strength of relevant controls and of management's response to the identified risks, and residual risk (a re-evaluation of risk in light of controls and management's response). at the end of this process, residual risks are compared to gross risks for reasonableness. See Exhibit 8 for a graphical representation of this risk assessment.