As stated in the AICPA's statements on standards for attestation engagements, auditors should not perform reviewlevel work for reporting on internal control or compliance with laws and regulations.
The internal control is affected by the laws and regulations.