Are You Evaluating Internal Controls Top-Down?