auditors are required to obtain a sufficient understanding of each component of a client’s internal control. this understanding is used to assess control risk and plan the audit of the client’s financial statements.