A risk-based approach to testing and managing your internal controls over financial reporting sounds great, but first you need to assess just what your financial reporting risks are.

To that end, Bill Stepaniuk never goes into a meeting empty handed. Or, as he likes to put it: “I’m a paper-half-full type of person.”