NOTE:The auditor “selects for testing … controls” as it is practically impossible to test every ICFR; however, Management should design and operate every ICFR effectively to mitigate every misstatement risk. Auditors begin their (misstatement) risk assessment “at the financial statement (F/S) ...