4 steps to design INTERNAL CONTROLS