Using internal reporting data to strengthen governance and risk oversight