Choice "C" is correct. The auditor identifies internal controls relevant to specific financial statement assertions, and then performs tests of controls to evaluate their effectiveness in preventing material misstatements in those assertions. Control risk should be assessed in terms of financial statement assertions.
Choice "d" is incorrect. Control risk is not assessed in terms of specific controls.
Choice "b" is incorrect. Control risk is not assessed in terms of types of potential fraud.
Choice "a" is incorrect. Control risk is not assessed in terms of control environment factors.
