https://de.frojeostern.com/post/when-obtaining-an-understanding-of-an-entitys-control-environment-an-auditor-should-concentrate-on-the-substance-of-controls-rather-than-their-form-because