If the auditor concludes, BASED on his or her understanding of INTERNAL control, that controls are likely to be ineffective or that evaluation of their effectiveness would be INEFFICIENT, then the auditor may assess control risk at the maximum level for some or all financial statement assertions.

If specific controls are likely to prevent or detect material misstatements and the auditor PERFORMS tests of controls in order to evaluate the effectiveness of the controls identified, then ASSESSMENT of control risk below the maximum level is permissible.

If the auditor concludes, based on his or her understanding of internal control, that controls are likely to be ineffective or that evaluation of their effectiveness would be inefficient, then the auditor may assess control risk at the maximum level for some or all financial statement assertions.

If specific controls are likely to prevent or detect material misstatements and the auditor performs tests of controls in order to evaluate the effectiveness of the controls identified, then assessment of control risk below the maximum level is permissible.