When obtaining an understanding of an entity's control environment, an auditor should concentrate on the substance of management's policies and procedures rather than their form because

a. The auditor may believe that the policies and procedures are inappropriate for that particular entity. b The policies and procedures may be so weak that no reliance is contemplated by the auditor. c Management may establish appropriate procedures and policies but not act on them. d The board of directors may not be aware of management's attitude toward the control environment.