Suppose you assessed CR as Low and your control testing indicated that the control activities were operating effectively. Later in the audit, when gathering substantive evidence by obtaining confirmations from customers, you discovered several misstatements in accounts receivable related to the existence assertion.

a. Speculate as to how it could happen that control testing indicates the controls are operating effectively, yet misstatements in the financial statements are detected by substantive tests of details.

b. What effect, if any, should this detection of misstatements have on your control risk assessment?