An IS auditor assessing an organization’s information systems needs to understand management’s approach regarding controls. Which documentation should the audit...