incidents by IT systems (suspect amounts, amounts exceeding authorised thresholds, unexplained amounts, etc.) Self-assessment of activities and processes Assessment by each department of business processes in terms of: compliance with internal control rules; actual implementation by operating entities.