Choice "B" is correct. Assessing risk based on the effective operation of controls involves (1) identifying specific internal controls relevant to specific assertions that are likely to prevent or detect material misstatements in those assertions, and (2) performing tests of such controls to evaluate their effectiveness.
Choice "d" is incorrect. Analytical procedures are used for planning purposes, as substantive tests, or as a final overall review. They are not used to support a risk assessment based on the effective operation of controls.
Choice "c" is incorrect. Tests of details of transactions and account balances to identify potential errors and fraud are substantive tests. They are not used to support a risk assessment based on the effective operation of controls.
Choice "a" is incorrect. The auditor may not assess risk based on the effective operation of controls unless tests of controls are performed. However, if the audit effort required to perform tests of controls exceeds the potential reduction in substantive testing, tests of controls will not be performed because doing so would reduce audit efficiency.