The scope of control is aimed at establishing a comprehensive framework for information security, so that the framework may influence behavioural patterns, values, and philosophies of the entire organization with the goal of creating a culture of internal control at a corporate level.