Which of the following types of evidence would an auditor most likely consider to determine whether internal controls are operating effectively?