and improvement. – A control effectiveness profile methodology to determine the scope and frequency of audits on the basis of risk. – Improved governance and reporting to ensure corrective actions are completed on time. – Increased participation of operational leaders on audits. – Redesigned first tier assurance framework with a greater use of risk and control metrics and more targeted self-auditing.