According to the GAO, internal control is a process used by management to

According to the U.S. Government Accountability Office (GAO), internal control is a continuous process implemented by management and personnel to provide reasonable assurance that an entity's objectives are being met. These objectives are typically categorized into three areas: effectiveness and efficiency of operations, reliability of reporting for internal and external use, and compliance with applicable laws and regulations. The entire framework of internal control is designed to manage risks that could prevent the entity from achieving these strategic goals.

B. design an ERM system.

Designing an Enterprise Risk Management (ERM) system is a broader strategic activity. Internal control is a fundamental component within an ERM system, not the process used to design it.

C. set the tone at the top.

"Tone at the top" is a critical aspect of the Control Environment, which is one of the five components of internal control. It is not, however, the overall purpose of the entire process.

D. develop a strategic plan.

Developing a strategic plan is the process of setting an entity's objectives. Internal control is the process used to help achieve those pre-established objectives, not to create the plan itself.

1. U.S. Government Accountability Office. (2014, September). Standards for Internal Control in the Federal Government (GAO-14-704G). Page 10, Paragraph 1.03. "Internal control is a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved."

2. U.S. Government Accountability Office. (2014, September). Standards for Internal Control in the Federal Government (GAO-14-704G). Page 11, Paragraph 1.06. This section explicitly lists the three categories of objectives (operations, reporting, compliance) that internal control helps an entity achieve.

3. U.S. Government Accountability Office. (2014, September). Standards for Internal Control in the Federal Government (GAO-14-704G). Page 29, Paragraph 2.04. This paragraph describes "tone at the top" as part of the Control Environment component, stating, "Management and the oversight body set the tone at the top." This confirms it is a part of the system, not its overarching purpose.