Professional documentation of internal control and risk management