RSM interview question

About internal control testing, risks