Consider the case whereby the risk of overreliance is 5%, the sample size is 40, and the auditor detects no deviations in the operation of the control. What can we conclude?

a. The sample size is too small.

b. A conclusion cannot be made without a specified tolerable deviation rate.

c. This is good news; no deviations were found, so we conclude that the control is working effectively.

d. The upper limit of deviations is 7.3%, so we conclude that the control is not working effectively.