7.11 Auditors should obtain an understanding of the internal control environment, as well as specific internal controls, that are significant to the audit objectives, including internal control over compliance with legal and regulatory requirements, and consider whether the internal controls have been placed in operation.
Auditors, on finding a lack of compliance, should impose the controls themselves.