Considering SAS 109 what kind of information should auditor have gathered during the preliminary stage of this audit in order to answer clins questions about the internal control? What sources are available to the auditors to help understand the client's internal control and assess its control risk?