3 methods to identify internal control weaknesses