What should the internal auditor do this? Name two point