Internal controls, an internal audit function, and an audit committee are all elements of a strong corporate governance system. How should an external auditor evaluate these elements in making a risk assessment? What are the ethical signs that each system is operating as intended?