Auditors should follow the AICPA's Statements on Standards for Attestation Engagements when providing opinions on internal control over compliance with laws and regulations or on internal control over financial reporting.