To determine the scope of the department's services, they decided to use: 1) a risk-based assessment methodology that is tied to the committee of sponsoring organizations of the Treadway comission (COSO) internal control framework and 2) a consumer products business process model that the CAE had previously used when he worked for KPMG LLP.