premise: In keeping with their role as advisors and facilitators, most of the security managers said that they relied significantly on auditors to test controls.
hypothesis: Most security managers stick to their established roles and let the auditors handle the control testing.