Internal scrutiny and risk