Statutory Auditors are not internal auditors they cannot go and check all controls or many controls, because internal controls is not there objective there objective is financial statements.
so we dont check all the controls, we check only those controls which we expect to function properly and compensate the risk at assertion level, for example weekly stock take ensures “existence” of stock, so it covers assertion of existence. so we can decide to check whether this controls really operates and is it effective.
so we check those controls which are expected to work and cover RMM at assertion level.