Evaluate internal controls to identify weaknesses and any associated risks, as well as make recommendations on how to mitigate those risks.