The internal control system and risk management