When continuous monitoring systems are being implemented, an IS auditor should FIRST identify: