Is an auditor required to have a written report on the auditors understanding of internal control and the assesment of control risk in all audits?