1. For public companies, what extra responsibility do auditors have under PCAOB Standard 2201, including the six steps?

2. When the auditor discovers an internal control deficiency, how and to whom is that communicated?