The report on an attestation engagement should disclose deficiencies in internal control , including internal control over compliance with laws and regulations , that are material to the subject matter or assertion .
There are deficiencies in their internal control methods .