Level one includes an annual risk assessment, one-on-one interviews with senior managers, a risk and control assessment survey, a review of issues from past audits, and the creation of action plans to mitigate risks and monitor results.