Design your audit to achieve a low assessed level of control risk