for certain controls, such as segregation of duties, documentary evidence may not exist. an auditor would most likely test the procedures by: