If an auditor decides to assess control risk as low based on IT application control procedures, which of the following would not be part of the auditors strategy for testing controls?

a. Testing the effectiveness of management review controls used to monitor the results of operations.

b. Testing the effectiveness of manual follow-up procedures.

c. Testing the effectiveness of the application with test data.

d. Testing the effectiveness of IT general control procedures.