Which type of control is the auditor recommending?