If internal controls are strong, O the auditor does not need to test the controls the auditor should allow the internal audit function to conduct any testing O the auditor can usually assess control risk as high O the auditor can usually assess control risk as low