In the event that both internal and external auditors are carrying out the cybersecurity audit, Critical Information Infrastructure owners shall seek approval from the Commissioner for the appointment of both internal and external auditors.