Which layer should the auditor recommend the client address?