Your preliminary assessment of control risk over cash disbursements is low. You base this assessment on the requirements that each cash disbursement be supported by a purchase requisition, a properly approved purchase order, an approved vender list, an invoice, and a receiving report that requires counting of incoming goods. The company has made 7260 purchases during the year. The tolerable deviation rate is 3% and the expected deviation rate is less than .25%. The appropriate risk of assessing control risk too low is 5%.

What are the possible audit responses if you find two deviations?