How would one design internal controls to reduce risk? What potential failure points can put controls at risk? Provide examples from a publicly traded company.