10 steps to facilitate internal-audit oversight