The organizations focused their monitoring efforts primarily on ( 1 ) determining if controls were in place and operating as intended to reduce risk and
They want to determine if there are certain controls .