An auditor's risk assessment is based on the assumption that controls are operating effectively. Which of the following was not a step in making this assessment...