An outside auditor must evaluate the client's internal controls and report on the internal controls as part of the audit report