purchasing insurance against theft by employees who frequently handle cash follows which principle of internal control?