The control activities used by an organization to address improper payments vary according to the specific threats faced and risks incurred; differences in objectives; managerial judgment; size and complexity of the organization; operational environment; sensitivity and value of data; and requirements for system reliability, availability, and performance.