Focusing on those contractors and locations considered to represent the greatest risk, the plan identifies corporate and operational risks, and develops an audit and assurance programme to demonstrate effective controls are in place before and during all projects.