Final answer:
An auditor must perform tests of control, substantive tests, and tests to evaluate the risk of monetary misstatement regardless of the assessed level of control risk.
Step-by-step explanation:
Regardless of the assessed level of control risk, an auditor must perform:
- tests of control to determine the effectiveness of internal control.
- substantive tests to restrict detection risk.
- tests to evaluate the risk of monetary misstatement.