How do auditors obtain evidence about the operating effectiveness of monitoring controls?