3. Business processes and the design of internal controls, including the IT environment