which of the following is not an auditing procedure that is commonly used in performing tests of controls?