Text this: Risks as an object of internal control: identification and assessment