what are the key considerations when evaluating the design and testing of the operating effectiveness of internal controls in conjunction with a financial statement audit?