1. A method of auditing an enterprise, the method comprising: evaluating a set of risk controls associated with the enterprise to produce a first set of audit opinions; evaluating a set of risks associated with the set of risk controls to produce a second set of audit opinions; evaluating a set of processes associated with the set of risks to produce a third set of audit opinions; and evaluating a set of organizations associated with the set of processes to produce a fourth set of audit opinions.