An IS auditor has been asked to audit a complex system with computerized and manual elements. Which of the following should be identified FIRST?

A. Manual controls
B. System risks
C. Programmed controls
D. Input validation