.51

The auditing procedures performed in response to identified risks of material misstatement due to fraud will vary depending upon the types of risks identified and the account balances, classes of transactions, and related assertions that may be affected. These procedures may involve both substantive tests and tests of the operating effectiveness of the entity's programs and controls. However, because management may have the ability to override controls that otherwise appear to be operating effectively (see paragraph .08), it is unlikely that audit risk can be reduced to an appropriately low level by performing only tests of controls.