In the context of biomedical auditor, which principle most directly governs biomedical auditor risk management & control practices?