What should the internal control system consist of?