by auditors in order to identify policy and related control deficiencies.
Auditor have to assess policies and control deficiencies