Choice "D" is correct. In response to discovering a deviation from a prescribed control procedure, the auditor should make inquiries to understand the potential consequence of the deviation.
Choice "b" is incorrect. The auditor should not simply assume that a deviation is an isolated occurrence without audit significance.
Choice "c" is incorrect. There is no requirement that the auditor report all deviations to the next higher level of authority within the entity. Note that a single deviation does not necessarily represent a control deficiency.
Choice "a" is incorrect. The auditor would not increase the sample size in tests of controls just because he or she discovers a single deviation. Instead, the auditor would estimate the population deviation rate based on the number of deviations in the sample.