Regardless of the assessed level of control risk, an auditor of a non-public company would perform some:
a) Substantive procedures
b) Risk assessment procedures
c) Additional tests of controls