Which of the following statements is correct with respect to the testing of controls in an audit of an issuer$$s financial statements?

Tests of controls are not required to be performed on assertions for which substantive procedures alone provide insufficient audit evidence.

The evidence necessary to support an auditor$$s control risk assessment usually does not depend on the degree of reliance the auditor plans to place on the effectiveness of a control.

An auditor should assess control risk at less than the maximum for all relevant assertions.

An auditor must obtain evidence that controls are operating effectively during the entire period of reliance if the auditor plans to assess control risk at less than the maximum.