Choice "D" is correct. Some risk assessment procedures performed to obtain an understanding of internal control may provide evidence about operating effectiveness, even if they were not intended for that purpose. This is possible because the procedures performed to achieve one objective may also provide evidence regarding the other.
Choice "c" is incorrect. Audit evidence that was obtained in prior audits about the effective design or operation of internal controls may be considered by the auditor in assessing control risk in the current audit.
Choice "a" is incorrect. The auditor is always required to document the assessment of risk and the basis for the assessment.
Choice "b" is incorrect. The lower the assessed level of control risk (that is, the greater the reliance placed on the control), the more assurance the auditor must gather that the controls are operating effectively.