What factor determines the severity of an internal control deficiency when completing the audit of internal controls for an issuer?

a) The size of the organization

b) The auditor's experience

c) The likelihood and magnitude of potential misstatements

d) The length of time the deficiency has existed