The organization defines in the auditable events that the information system must be capable of auditing based on a risk assessment and mission/business needs.