XYZ Company is a medium-sized private company engaged in the business of manufacturing car parts. When planning the audit, you noted the following: ► The Company does not have a formal risk assessment processes, but the CEO and CFO are responsible for identifying risks relating to business and financial reporting, respectively, and reports risks and results of operations to the Board of Directors. ► Through inquiry, we confirmed that management is not aware of any liabilities or litigations that arose due to the lack of a risk assessment process. ► The absence of a formal risk assessment process seems appropriate in the circumstances. ► The audit team has not yet identified any significant deficiencies (or material weakness if required to be communicated in the jurisdiction) on any components of the system of internal control at the entity level. Considering the information given, which of the following conclusions would be most appropriate?If we do not identify any liabilities or litigations due to internal control deficiencies during the audit, we may conclude that the lack of written risk assessment processes is a significant deficiency (or material weakness if required to be communicated in the jurisdiction). We conclude that the lack of written risk assessment processes is a significant deficiency (or material weakness if required to be communicated in the jurisdiction) at this stage.