auditing requirements