Risk assessment in an extended enterprise environment: redefining the audit model · Study