25.37 To respond to identified risks that are not reasonably possible in a financial statement audit, the audit team ordinarily does not require an understanding of internal controls related to the risk. This is because it is ordinarily sufficient to address the risks with substantive procedures alone, such as analytical procedures or substantive procedures such as high value testing.