Internal controls primarily belong to the risk response category of Reduction. They are measures put in place to mitigate either the likelihood or impact of identified risks within an organization. By implementing effective internal controls, an organization can better manage and reduce potential risks to an acceptable level.