Assessing control risk may be performed concurrently during an audit with obtaining an understanding of the entity's internal control.

Evidence about the operation of controls in prior audits may not be considered during the current year's assessment of control risk.

The basis for an auditor's conclusions about the assessed level of control risk need not be documented unless the auditor's risk assessment is based on the effective operation of controls.

The lower the assessed level of control risk, the less assurance the evidence must provide that the controls are operating effectively.