Assessing the system of internal control