auditor may recommend a greater role for users if they are not involved in approving alternatives or validating system requirements .
auditor may recommend a greater role for users if they are involved in approving alternatives