If an internal auditor’s evaluation of internal control design indicates that the controls are designed adequately, the appropriate next step would be to:
a. Test the operating effectiveness of the controls.
b. Prepare a flowchart depicting the system of internal controls.
c. Conclude that residual risk is low.
d. Conclude that control risk is high.