An assessable unit is an agency program or administrative function or subdivision that is to be subject to an internal controls vulnerability assessment.