To assess risk by determining the nature and extent of improper payments, the following strategies should be 
They had strategies to deal with the improper payments.
They did not think to determine the risks involved.