Internal control processes in an organization require that all investments exceeding $20, 000 receive authorization from both the president and treasurer. After conducting a sample of these transactions, an auditor determined that 10 of the 500 investments in the sample had not included both required authorizations. The sample has a five percent acceptable error rate. Based on this sample, which of the following actions should the auditor take?