anchor: Auditors should include audit documentation on their assessment of risk, and, when risk factors are identified as being present, the documentation should include
positive: The auditors need to include a bunch of documentation.
negative: The auditors will find no risk at all.