In the initial meet-n-greet meeting with the (major accounting firm) auditors, they told us that nomatter the quality of what we present them, they *will* call out deficiences that must be presented to the Board of Directors.
They said that if they present no deficiences, then this would be evidence that they didn't look closely enough, since it is assumed under the law (I $#!t you not) that no organization can actually comply with Sarb-Ox without lying about it.
I am not kidding.