AICPA standards and GAGAS require that auditors use their understanding of internal control relevant to financial statement assertions affected by laws and regulations to identify types of potential misstatements, consider factors that affect the risk of material misstatement, and design substantive tests.