Responding to identified risks involves developing an audit approach that addresses those risks. Which of the following statements about the planned audit approach is true for the revenue cycle?

a$.$ The audit approach needs to include tests of controls, substantive analytical procedures, and tests of details.

b$.$ The audit approach will typically require more evidence for higher risk assertions than lower risk areas.

c$.$ The audit approach should only follow the audit firm's standardized audit program.

d$.$ The sufficiency and appropriateness of selected procedures will not vary across assertions.