Internal control should provide reasonable (but not necessarily absolute) assurance, which means that:

a. Internal control is management's, not the auditor's, responsibility.

b. An attestation engagement about management's internal control assertions may not necessarily detect all reportable conditions.

c. The cost of control activities should not exceed the benefits.

d. There is always a risk that reportable conditions may result in material misstatements.

Choose the correct answer.