To determine the scope of the department’s services, they decided to use: 1) a risk-based assessment methodology that is tied to the Committee of Sponsoring Organizations of the Treadway Commission (COSO) internal control framework and 2) a consumer products business process model that the CAE had previously used when he worked for KPMG LLP.