Includes “… While less paper can be good, it’s important to keep some evidence of your key controls in action. … Auditors need to understand the strength of your control system so they can assess audit risk and properly plan your audit. In some cases, auditors might perform tests of those key controls to gain even more comfort – either because they are required to do so or because it reduces audit work in other areas, such as testing of transactions (substantive testing).”