Marie and David are discussing the topic of internal control while working on the audit of one of their attestation clients. Marie mentions to David that she is keen to understand more about internal controls. Which of the following statements by David is accurate and would be helpful to Marie? We don't spend much time auditing internal control for ongoing attestation clients as there's really no need. During most audits, we start by examining entity-level controls, and work our way down to transaction-level controls. We typically start the audit of internal control by obtaining written assurances from management. These assurances help to indemnify the auditor in the event of a lawsuit. Internal controls are generally pretty standardized throughout all of our audit clients