Which of the following is the PRIMARY role of the IS auditor in an organization's information classification process?