What is meant by the "tone at the top," and where does it fit into the COSO framework? Why is the tone at the top so important? How would an auditor go about assessing the tone at the top and its potential effect on the quality of an organization's controls?