An organization has a mature control environment but limited internal audit resources. Given this scenario, on which of the following should the internal audito...