the document that outlines the auditor's understanding of the entity and potential risks as well as the strategy to be followed by the auditor is called the