Each of the following is a method to evaluate internal controls based on the framework set by the Committee of Sponsorin Organizations (COSO), except Distinguishing economy risk from industry risk and enterprise risk. Evaluating internal control systems that focus first on risk identification of specific losses. Testing to determine whether the controls are operating effectively and have prevented losses in the past. Identifying mitigating controls to prevent losses