You can certainly be asked to suggest suitable internal controls and then to suggest how to test those controls.
However, real questions are more careful to specify how much detail you should go into. See, for example, Q$ June 2014 where you are asked to identify 5 deficiencies and suggest how to correct them.