How to design and evaluate internal control in finance and accounting departments?

First step is to identify the key business processes and then to identify the "risks" associated with those business processes.
Thereafter, internal controls are designed for all those risks in line with their importance and occurence (high to low).