How to effectively answer an audit finding from COA?