Once the auditor detects a control deficiency, which of the following steps must he or she take first?
a. Perform tests of other controls related to the same assertion as the control deemed ineffective.
b. Evaluate the severity of the deficiency on the auditor’s control risk assessment for that assertion.
c. Modify the planned substantive procedures as a result of the deficiency.
d. Test the deficient control, assuming a maximum level of risk.