Auditing Entity-level controls of IT