Answer:
Objectively assess a company's IT and/or business processes.
Assess the company's risks and the efficacy of its risk management efforts.
Ensure that the organization is complying with relevant laws and statutes.
Evaluate internal control and make recommendations on how to improve.