The control activities used by an organization to address improper payments vary according to the specific threats faced and risks incurred; differences in objectives; managerial judgment; size and complexity of the organization; operational environment; sensitivity and value of data; and requirements for system reliability, availability, and performance.
The organization controlled activities with various issues that they have encountered.
There were no monitoring of the activities and any of their performances. 