internal controls have at least three specific objectives in regards to fraud. which of the following is not one of those objectives? a. detection b. mitigation c. deterrence d. prevention