Scan its business environment, presumably on an enterprise-wide basis, to determine what pressures the organization faces, especially the risk of criminal conduct and violating other applicable laws, and more broadly, to gather benchmarking data to compare to industry standards and best practices.