The report on an attestation engagement should disclose deficiencies in internal control, including internal control over compliance with laws and regulations, that are material to the subject matter or assertion.
There are deficiencies in their internal control methods.