Which of the following is a step in an auditor's decision to assess control risk at below the maximum?
A. Apply analytical procedures to both financial data and nonfinancial information to detect conditions that may indicate weak controls.
B. Perform tests of details of transactions and account balances to identify potential errors and fraud.
C. Identify specific internal control policies and procedures that are likely to detect or prevent material misstatements.
D. Document that the additional audit effort to perform tests of controls exceeds the potential reduction in substantive testing.