the strength of relevant controls and of management’s response to the identified risks, and residual risk (a re-evaluation of risk in light of controls and management’s response). At the end of this process, residual risks are compared to
gross risks for reasonableness. See Exhibit 8 for a graphical representation of this risk assessment.