Why when IS auditors conduct audit, testing contols based on the organisation policy and controls put in place by such organisation? $2.$ why they are also testing based on the best practice and, framework and standards that organisation subscribe too rather than all best practice, frameworks and standards? $3.$ How this two affect the audit conclusions?