Indeed, it's exactly that point that I'm leading up to. The alternative is what I want to get to.
So as I was saying, the auditor's report gives no assurances on internal control. In fact, the Auditor General will issue cautions to management regarding the limitations of its work. So the Auditor General will say to us that:
...when the auditor's risk assessment includes an expectation of the operating effectiveness of controls, sufficient appropriate audit evidence will be obtained through tests of controls to support the assessment, but the scope of the auditor's review of internal control will be insufficient to express an opinion as to the effectiveness or efficiency of the entity's controls.
This is a caution that the Auditor General gives to management at the commencement of an audit of a set of financial statements.