Adding:
I was looking for one of the similar rejections as an example and came across this post:
In this case, the ISRG staff pointed to the WebTrust audit docs.
The most recent post I was thinking of, was this:
6 Likes