“An audit generally requires the presentation of evidence of control design and effectiveness, where a review often does not.”