During an audit of identity and access management, an IS auditor finds that the engagement audit plan does not include the testing of controls that regulate acc...