Choice "C" is correct. Tests of details of transactions are used to detect material misstatements in the financial statements after the auditor has assessed risk, not as part of making this assessment.
Choice "a" is incorrect. Tests of controls are required to support the auditor's assumption that controls are operating effectively.
Choice "b" is incorrect. Obtaining an understanding of each of the five components of internal control is required before making an assessment of control risk. The entity's accounting system (part of the information and communication component) and control environment are part of the five components.
Choice "d" is incorrect. Considering whether control activities can have a pervasive effect on financial statement assertions is part of the auditor's risk assessment process.