" A Top-down Approach to Risk Management and Internal Control (Using a Process Point of View to Reduce Documentation Costs) "