Understanding internal control and testing its operating effectiveness can be done at the same time. Even if control risk is assessed as maximum, you don’t stop learning about how controls work or stop testing them; you can obtain an understanding of the controls and run tests of controls in the same engagement. These tests provide evidence about whether the controls are operating effectively, which helps you gauge whether control risk might actually be lower than initially estimated or confirm that it remains high, guiding the extent of substantive testing you’ll need. In other words, you can gather control-related evidence while continuing substantive procedures as needed, rather than choosing between them in sequence. The other statements impose false requirements—tests of controls aren’t strictly necessary just because you’re planning a mainly substantive approach, and control risk isn’t guaranteed to be at maximum after testing, nor must you always assume maximum after performing tests.

The main idea here is that the fundamental definition of auditing does not change just because the environment is electronic. Auditing remains a systematic process of obtaining and evaluating evidence about assertions to determine whether they align with established criteria. That core meaning holds whether you’re auditing in a paper-based setting or in an IT-driven environment. What changes in planning for an electronic context are the sources of evidence, the techniques used to test controls, and the specific risks you focus on—for example, relying on data analytics, testing IT general controls, and assessing automated processes. So the definition stays the same, while the way you approach planning adapts to technology. The other statements—about purposes, procedures, or standards not changing—aren’t as reliable in an IT context, because the environment pushes you to adjust procedures and standards to address IT risks and controls.

In planning a year-end audit, it’s standard to schedule substantial testing for interim dates. Doing so lets you gather a lot of evidence early, spread the workload, and focus on areas that are less likely to change dramatically by year end. Importantly, this doesn’t replace the need for year-end procedures—you still verify year-end balances and consider events after the interim dates to ensure the financial statements are complete and accurate. Other statements aren’t universally true. Engaging an audit after the fiscal year ends is a normal part of audit planning, so it isn’t correct to say it shouldn’t be accepted. Inventory counts don’t have to be observed exactly on the balance sheet date; counts can be performed before or after with proper cut-off testing. And it’s appropriate to inform those charged with governance about the planned procedures; withholding that information isn’t correct. So, carrying out substantial parts of the examination at interim dates is an acceptable practice.

Understanding how control risk affects audit documentation helps here. When control risk is set at the maximum, it means the auditor cannot rely on the entity’s internal controls and will proceed with substantive procedures throughout the audit. In this framing, the decision to not rely on controls is a straightforward conclusion, so no separate documentation of the reason for that assessment is considered necessary within the given context. That’s why the statement asserting no documentation is the best choice. The other options imply that documentation is required in situations where the assessment is either less than maximum or maximum, which doesn’t align with the scenario described.