You are performing the audit of a small entity with a limited control environment. In planning the audit, what are you required to do?

Assess control risk at maximum for all relevant assertions.

Reduce control risk below maximum if controls relevant to the audit exist and were properly designed.

Determine whether controls relevant to the audit were properly designed and implemented.

Assess whether controls were operating effectively during the reporting period.