I would pay the extra money for auditing (we did audits every three years, reviews on the other two) and then have a systematic way to insure that the recommendations in the management letter were followed.
CEO, education services, $21 million revenues when we told, operated internationally, headquartered in US.