Choice "B" is correct. The report should state that the communication is intended solely for the use of management, those charged with governance, and others within the organization.
Choice "d" is incorrect. Significant deficiencies may represent a conscious decision by management to accept that degree of risk because of cost or other considerations. The auditor may elect to use a primarily substantive approach to test balances, so internal control deficiencies do not necessarily constitute a scope limitation.
Choice "c" is incorrect. No requirement to perform tests of controls exists. Significant deficiencies may be identified through the consideration of internal control, the application of audit procedures to balances or transactions, or otherwise during the course of the audit.
Choice "a" is incorrect. Significant deficiencies may be communicated during or after the audit.