Which of the following should be established FIRST when initiating a control self-assessment program in a small organization?