jacob is conducting an audit of the security controls at an organization as an independent reviewer. which question would not be part of his audit?