Within each process, the internal audit personnel assess gross risk (threats or impediments
to the accomplishment of corporate or process objectives), the strength of relevant controls and of
management’s response to the identified risks, and residual risk (a re-evaluation of risk in light of
controls and management’s response). At the end of this process, residual risks are compared to
gross risks for reasonableness. See Exhibit 8 for a graphical representation of this risk assessment.