The organizations focused their monitoring efforts primarily on (1) determining if controls were in place and operating as intended to reduce risk and
They want to determine if there are certain controls.