If an internal auditor identifies an exception while testing, which of the following may be appropriate?
a. Test additional items to determine whether the exception is an isolated occurrence or indicative of a control deficiency.
b. Gain an understanding of the root cause, that is, the reason the exception occurred.
c. Draft an observation for the audit report.
d. All of the above.