In evaluating the results of a compliance test that utilized statistical sampling, what course of action could the auditor take if the computed upper deviation rate (sample deviation rate projected to the population and adjusted for sampling risk) exceeded the tolerable deviation rate?

a. Conclude that control risk assessment was too low and increase substantive tests

b. Select additional items for testing and re-evaluate the results

c. Switch to a non-statistical sampling approach and ignore the adjustment for sampling risk

d. Both A or B are acceptable

e. A, B, or C are all acceptable