“Utilization of NQR for the review of third-party attestation reports has enabled us to expand and institutionalize our oversight program.”