On the audit of an issuer, if an audit team completes a test of controls on a control activity that is designed to mitigate the risk of material misstatement for a relevant assertion, concludes that the control activity is not effective and that there is a control deficiency, what should the auditor do next? 

a. Discuss the finding with the client and ask if a compensating control exists. 

b. Issue an adverse report on the internal control over financial reporting. 

c. Document the results of tests of controls and complete additional substantive testing procedures. 

d. None of the above answers is correct.