premise: As stated in the AICPA's statements on standards for attestation engagements, auditors should not perform reviewlevel work for reporting on internal control or compliance with laws and regulations.
hypothesis: The internal control is affected by the laws and regulations.