Procedures to obtain an understanding of internal control do not generally provide sufficient evidence that a control is operating effectively, except in the case of:
a. well-defined controls in low risk cycles.b. cycles that contain no significant deficiencies or material weaknesses.
c. automated controls.
d. all of the above.