In the course of an audit of a public company, the auditors determine that controls over payroll are weak and susceptible to serious breaches. The lead auditor insists that the programmers have access to payroll data and can enter and modify the data. The lead auditor is concerned about the existence of employee ghost names, and the lack of effective internal controls. Assuming the lead auditor is correct, what audit procedures should the auditors perform in order to form an opinion and report on the effectiveness of internal controls? Analyze how ACL may be useful to the audit work. Hint: The client must comply with the Sarbanes Oxley Act of 2002 that relates to (1) maintaining effective internal controls over financial reporting and (2) reporting material weaknesses in internal controls.