Which of the following comes closest to outlining the auditors' responsibility for considering internal control in all financial statement audits? a. an understanding of the control environment, information and communication, risk assessment and monitoring is necessary; an understanding of control activities is only necessary for areas in which the auditor is performing tests of controls. b. the auditor must obtain an understanding of each of the five internal control components sufficient to assess the risks of material misstatement for the audit. c. when tests of controls have been performed, control risk must be assessed at a level less than the maximum. d. an understanding of the control environment is necessary, but no understanding of the other components is necessary unless control risk is to be assessed at a level less than the maximum.