QUESTION 36 If the auditor determines that an effective compensating control does not exist, or tests of controls show that the compensating control is not functioning as designed the auditor would lower inherent risk surrounding the engagement as a whole the auditor makes no changes to the overall audit risk assessment for the related account and assertion, and the planned audit strategy the auditor revises the overall audit risk assessment for the related account and assertion, and the planned audit strategy the auditor concludes that internal control is weak, and issues an appropriate opinion QUESTION 37 An example of a risk created by an IT system is increased efficiency in processing transactions less documentary evidence potential availability of real-time financial Information the extra cost of staffing an IT support function QUESTION 38 Which process involves assessing the design and operation of controls on a timely basis and taking necessary corrective actions? Control activities Monitoring Information and communication Risk assessment