Which of the following should the IS auditor use to BEST determine whether a project has met its business objectives?