When developing an effective risk-based plan to determine audit priorities, an internal audit activity should start by: