The correct answer to question is option A. According to the COSO Report, an internal control system must include five interrelated components at the same time to be effective. These five components are the control environment, risk identification, control activities, IT and communication and monitoring. In order to establish internal control in the enterprise, information and communication systems should be monitored and risk assessments should be made. Organizational structure, management philosophy and planning components need to be considered by senior management to establish internal control, but do not fully express the components of internal control. Likewise, the components expressed in other embodiments do not fully express the internal control components.