internal audit myths