or when the external auditor, for the purpose of financial statement audit, evaluates a business process outside of the scope of management’s assessment of internal control and identifies a deficiency that is deemed to constitute a significant deficiency of internal control,