Why is the assessment of control risk a critical part of any financial statement audit? What is the impact on an auditor's financial statement audit strategy if control risk is set at a high level versus being set at a low level? What is the impact on the financial statement audit if an auditor sets control risk too low, tests controls for operating effectiveness to justify the risk, and then learns that controls are not operating effectively?