An auditor uses the audit evidence provided by the understanding of internal control and the assessment of the risks of material misstatement to determine the nature, timing, and extent of Tests of controls.

Compliance requirements.

Attribute tests.

Further audit procedures.