How does an internal auditor verify that an organization's emergency preparedness procedures are adequate and implemented?