Internal audit reports must be provided to the audit committee without management filtering.