if the auditor determines that internal controls are not functioning as designed, and a compensating control does not exist, the auditor will assess control risk and the risk of material misstatement (rmm) as