Define the scope of the audit, goals, purpose, accountability, communications, and methodology. Audits may take the form of an external audit, formal internal audit performed by a vendor, or an informal, internal self-audit.