* In an ESOP, the auditor must obtain an understanding of internal controls in which of the following areas?