The auditor should refer to agency-specific requirements for more information.
The auditor should refer to the requirements if they have questions.
There has to be a lot of uses but you have to have a need.