Risk assessment & self-assessment - How to audit SAS V1.4