move audit specs to controller tests