… level. [4]   This may occur when an entity conducts its business using IT and no documentation of transactions is … the auditor to perform tests of controls that address the risk for which substantive procedures alone cannot provide …