After obtaining an understanding of an entity's internal control, an auditor may assess control risk at the maximum level for some assertions because the auditor

a. Believes the internal control policies and procedures are unlikely to be effective.

b. Determines that the pertinent internal control components are not well documented.

c. Performs tests of controls to restrict detection risk to an acceptable level.

d. Identifies internal control policies and procedures that are likely to prevent material misstatements.