ABSTRACT. PCAOB argues that the evidence provided by the auditor's tests of the effectiveness of controls depends upon the mix of the nature, timing, and extent of the auditor's procedures. Sullivan & Cromwell LLP holds that in the case of a financial reporting element that has a relatively high risk characteristic but the associated control has a very low risk of failure, the required level of evidence may be lower. INTOSAI maintain that entities that actively identify and manage risks are more likely to be better prepared to respond quickly when things go wrong and to respond to change in general.