Contracts should specify how problems are to be identified and reported.
How problems are identified and reported should be specified in the contract.
The site provides standards, guidance and information on internal auditing best practices.