Choice "A" is correct. The missing invoice should be counted as a deviation, resulting in a 2% sample deviation rate. However, this information alone is not sufficient to determine whether the control can be relied upon. The auditor would also need to know the upper deviation rate (or the allowance for sampling risk, which would allow the auditor to calculate the upper deviation rate). It is the upper deviation rate that needs to be compared to the tolerable rate in making decisions.
Choice "d" is incorrect. It is the upper deviation rate (and not the sample deviation rate) that needs to be compared to the tolerable rate in making decisions.
Choice "b" is incorrect. Since the auditor is willing to accept a 2% risk of assessing control risk too low, this implies that there is a 98% chance that he or she will make a correct decision.
Choice "c" is incorrect. Sample items selected by the auditor that cannot be located are generally considered deviations.