language internal risk controls documentation production excel control quality processes employees auditor devices process narratives microsoft iso oxley conducted line sarbanes access database system documented audit efficiency testing workers medical large engineering operational document lead