risk assessment and internal controls in auditing