What steps would you take to institutionalize the controls youd select for your organization? Where do the obstacles lie? Can you think of strategies to overcome them? If you already have a set of controls in place, discuss (if you know) how they were institutionalized, or how far institutionalization has progressed.