By assessing control risk as high, an auditor has determined that their client's system of internal controls:

a) is unlikely to be effective in mitigating inherent risks identified

b) is highly effective at preventing or detecting material misstatements

c) the auditor can focus more on tests of controls over substantive procedures

d) the auditor sets audit risk as high