I want to know why C is correct and why D is incorrect

55. Which of the following represents a corregt statement regarding internal control testing? (A) When auditors plan to use evidence about the operating effectiveness of internal control contained in prior audits, auditing standards require tests of the controls' effectiveness at least every other year. (B) The greater the risk, the less audit evidence the auditor should obtain that controls are operating effectively. (C) The auditor uses control risk assessment and results of tests of controls to determine planned detection risk and the related substantive tests for the financial statement audit. (D) Testing of internal controls can only be performed by the auditor at the end of the fiscal year