As stated in the AICPA's statements on standards for attestation engagements, auditors should not perform reviewlevel work for reporting on internal control or compliance with laws and regulations.
The auditors have standards for the internal control.
The auditors set the standards for the AICPA.