true or false: when obtaining an understanding of the control environment, it is important that auditors focus on the substance of controls, rather than their form