If the preliminary assessment of control risk indicates that the risk may be below the maximum level and that assessment would reduce overall audit time and effort, then the auditor must test those controls further to determine the appropriateness of their design and effectiveness. How is this testing of controls carried out in an audit?