anchor: The auditors' assessment of risk includes consideration of whether the entity has controls that are effective in preventing or detecting noncompliance.
positive: The auditor's assessment explains the controls that are effective in dealing with noncompliance.
negative: The auditor never completed their assessment regarding controls and noncompliance.