Which of the following should be the PRIMARY input when designing IT controls?