Having developed such a framework , an organization is well positioned to determine which control activities to implement to reduce risks and ultimately reduce fraud and errors .
An organization with such a framework is not able to decide what control activities to use .