Which of the following is true? A. Assessing control risk is not mandatory in an audit B. Documenting the assessment of control risk, but not the basis for the assessment, is mandatory in an audit C. Documenting the assessment of control risk and the basis for the assessment is mandatory in an audit D. None of the above