Auditing standards indicate that if control risk is assessed as low or moderate, the auditor must gain assurance that the controls are operating effectively.

Required
a. What is meant by testing the effectiveness of control procedures? How does an auditor decide which controls to test?
b. Do all control procedures need to be tested? Explain.
c. How is the auditor's assessment of control risk affected if a documented control procedure is not operating effectively?
d. Assume that an auditor needs to examine a document to determine that a control is working effectively and the client cannot locate the document. Should the auditor take another sample item? What should the auditor's conclusion be regarding the operation of the control if (i) the document cannot be found, and (ii) the auditor chooses another transaction and the documentation for that other transaction can be found?