which of the following statements are correct? multiple select question. auditors must make decisions regarding which locations to test based on the presence of entity-level controls and financial reporting risk. identifying controls to be tested is an objective task that requires little professional judgment. auditors must evaluate whether to test preventive controls, detective controls, or a combination of both. when testing, auditors should focus on key controls.