Review and evaluation of internal control