D is corrent because segregation of duties is a control activity over a specific type of transaction. A is incorrect because management’s risk assessment process is a company-level control. B is incorrect because controls to monitor the results of operations are company-level controls. C is incorrect because controls over drafting the financial statements are company-level controls.
