Obtaining an understanding of the internal control and assessing control risk:

1. are necessarily sequential audit steps.
2. is possible but not necessary in performing an audit.
3. needs to be documented only if the assessed level of control risk is less than high.
4. may be performed concurrently in an audit