If officials of the audited organization do not have such a process, auditors may wish to establish their own process.
If a process does not exist, officials can establish their own process.