The auditors have standards for the internal control.
As stated in the AICPA's statements on standards for attestation engagements, auditors should not perform reviewlevel work for reporting on internal control or compliance with laws and regulations.