Auditors should understand the five components of internal control that are sufficient to assess the risk of material misstatement of the financial statements, whether due to error or fraud, and to design the nature, timing, and extent of further audit procedures. When performing the risk assessment of a potential client, auditors should use sufficient understanding to come to this conclusion. Explain the difference between sufficient understanding and satisfactory and reliable evidence. What steps does an auditor take to determine the overall sufficiency and appropriateness of evidence? 250 Words.