$1.$ Identify Controls

a$)$ Identify key controls for acquisitions and for cash disbursements. After you decide on the key controls, include each control in one of the two matrices.

b$)$ Include a $$C$$ in the matrix in each column for the objective$($s$)$ to which each control applies. Several of the controls should satisfy multiple objectives.

$2.$ Identify Deficiencies

a$)$ Identify control deficiencies for acquisitions and for cash disbursements. After you decide on the deficiencies, include each deficiency in the bottom portion of one of the two matrices.

b$)$ Include a $$D$$ in the matrix in each column for the objective$($s$)$ to which each control deficiency applies.

$3.$ Assess control risk as high, medium, or low for each objective using your best judgment. Do this for both the acquisitions and cash disbursements matrices.