Three factors the auditor considers when assessing control risk are: (1) the auditor's belief concerning the effectiveness of internal controls, (2) the results of tests of controls, and (3) the cost-effectiveness of a reduced assessed control risk. Explain how these three factors are analyzed and assessed by an auditor to make a decision about whether or not the auditor can reduce substantive testing. A reduction in substantive testing may be permitted when?