After obtaining an understanding of internal controls and assessing control risk on the audit of a non-public company, an auditor decided to perform tests of controls. The auditor most likely decided that:
a) Risk of material misstatement is high
b) Internal controls are ineffective
c) Substantive procedures are unnecessary
d) Internal controls are reliable