for example, sales can be ordered through the emails and products are delievered at customer house. emails are read by 3 employees in sales department. and company has no control whether all emails are read or not . is this a control risk or is it simply a deficiency in internal control? here, no money is involved, so it should not be a control risk. i guess, control risk is where they couldnt find a material error in cash flow.