The Auditor May Identify Some Risks That Cannot Be Effectively

Multiple Choice

The auditor may identify some risks that cannot be effectively tested by substantive tests alone. For example, when there are paperless transactions (perhaps using EDI - electronic data interchange) . To address these risks, the auditor is required to

A) assess the design effectiveness of relevant controls and test them.
B) obtain an understanding of the controls and test them if reliance is intended.
C) obtain an understanding of the controls and assess their design effectiveness.
D) test the controls that address the paperless aspects of the transactions.