Assessing control risk and obtaining an understanding of an entity's internal control may be performed concurrently.

Control risk may be assessed sufficiently high to eliminate substantive testing for significant transaction classes.

Control risk may be assessed sufficiently low to eliminate substantive testing for significant transaction classes.

When assessing control risk an auditor should not consider evidence obtained in prior audits about the operation of control activities.