Auditors should include audit documentation on their assessment of risk, and, when risk factors are identified as being present, the documentation should include
The auditors need to include a bunch of documentation.