If the preliminary assessment of control risk indicates that the risk may be below the maximum level and the assessment would reduce overall audit time and effort, then the auditor must test these controls further to determine the appropriateness of their design and effectiveness. How is this testing of controls carried out in an audit?