Identify internal control weaknesses