Risk assessment procedures

In real life they have a software with hundreds of checklists for various entities operating in various businesses. They answer questions and make a decision if the risk for the area is low, moderate or high then the software gives them the risk analysis. Questions like: is the person who posts the invoices to the ledger the same person who authorises payment – if no the risk is lower if yes the risk is higher etc. And the rest is just an experiance. There are always some important area like inventory, property valuation, repairs or capital expenditures, employment or self-employment. For example if most of the sale is for cash the risk of income being incorrect is high if everything through the bank low.They think a little like detectives – firstly collect data about enterprise, control system, who does what and how and why and then try to find the gap, the place when something may go wrong. They ask questions themselves – how can I be sure if…and then they try to confirm if the answer or figure i correct – for example sending query to bank, to suppliers