When setting the scope for the identification and assessment of key risks and controls in...

Develop the scope of the audit based on a bottom-up perspective to ensure that all business objectives are considered.

Develop the scope of the audit to include controls that are necessary to manage risk associated with a critical business objective.

Specify that the auditors need to assess only key controls, but may include an assessment of non-key controls if there is value to the business in providing such assurance.

Ensure the audit includes an assessment of manual and automated controls to determine whether business risks are effectively managed.