An organization wants to assess the maturity of its internal control environment. The FIRST step should be to: