a$)$ is designed to help an entity think about risk in the same way that an auditor thinks about risk.

b$)$ is established only if the entity is subject to unusually high risk.

c$)$ is the entity$$s process for identifying and responding to business risks and the results of those risks.

d$)$ never allows management of an entity to decide to accept a risk without taking any action.