Choice "C" is correct. Material instances of fraud and illegal acts discovered need to be communicated in the auditor's report on compliance. If applicable, the report should state that other instances of noncompliance were communicated to management in a separate letter.
Choice "a" is incorrect. The report would state that consideration of internal control over compliance would not necessarily disclose all deficiencies, significant deficiencies or material weaknesses in internal control over compliance. Not only would there be no assurance that all controls were tested, the auditor would assert the exact opposite.
Choice "b" is incorrect. The auditor would not disclose the materiality criteria used in considering whether instances of noncompliance were significant.
Choice "d" is incorrect. The auditor does not express an opinion on whether the compliance affected the entity's goals and objectives.