auditor may recommend a greater role for users if they are not involved in approving alternatives or validating system requirements.
 auditor may recommend a greater role for users if they are involved in approving alternatives 