anchor: The organizations focused their monitoring efforts primarily on (1) determining if controls were in place and operating as intended to reduce risk and
positive: They want to determine if there are certain controls.
negative: There are no efforts to monitor controls.