Identify key controls for acquisitions and for cash disbursements. After you decide on the key controls, include each control in one of the two matrices. Include a "C" in the matrix in each column for the objective(s) to which each control applies. Several of the controls should satisfy multiple objectives. Identify key deficiencies for acquisitions and for cash disbursements. After you decide on the deficiencies, include each deficiency in the bottom portion of one of the two matrices. Include a "D" in the matrix in each column for the objective(s) to which each control deficiency applies. Assess control risk as high, medium, or low for each objective using your best judgment. Do this for both the acquisitions and cash disbursements matrices