scope and boundary audit