If an internal control exception is identified, the auditor_ must use published frameworks to determine if the exception is a control deficiency, a significant deficiency, or a material weakness should notify the Securities and Exchange Commission (SEC) within 14 days must use their professional judgment to determine if the exception is a control deficiency, a significant deficiency, or a material weakness should consider withdrawing from the engagement