1. A method performed by a computer system for auditing an enterprise, the method comprising: producing by the computer system an audit opinion for each risk control in a set of risk controls, each risk control being associated with a risk in a set of risks; producing by the computer system an audit opinion for each risk in the set of risks, the audit opinion for each risk being based, at least in part, on the audit opinions for its associated risk controls, each risk being associated with a business process in a set of business processes; producing by the computer system an audit opinion for each business process in the set of business processes, the audit opinion for each business process being based, at least in part, on the audit opinions for its associated risks, each business process being associated with an organization in a set of organizations; and producing by the computer system an audit opinion for each organization in the set of organizations, the audit opinion for each organization being based, at least in part, on the audit opinions for its associated business processes.