After Obtaining an Understanding of a Client's IT Control, an Auditor

Multiple Choice

After obtaining an understanding of a client's IT control, an auditor may decide not to perform tests of controls within the IT portion of the client's system. Which of the following would not be a valid reason for choosing to omit tests of controls?

A) There appear to be major deficiencies that preclude reliance on the stated procedure.
B) The time and dollar costs of testing controls exceed the savings in substantive testing if the tests show the controls to be operative.
C) The controls appear to be adequate and thus can be relied upon in assessing the level of control risk.
D) The controls duplicate controls existing elsewhere in the system.