If an auditor performs tests of controls and determines that the control is not effective, what should the auditor's next step in testing controls be?

1 Document the results of tests of controls and proceed with the planned audit strategy.

2 Determine if a compensating control exists.

3 Perform tests of controls on compensating controls.

4 Document the results of tests of controls and proceed with a primarily substantive approach.