Before concluding that internal controls can be relied upon, the IS auditor should: