Category COSO-based audit