Which of the following is the PRIMARY purpose of creating and documenting control procedures?

While documented procedures do facilitate audit and testing, this is a secondary benefit, not the primary reason for their creation, which is fundamentally about managing risk.

Control procedures are implemented to address identified risks, ensuring consistency and clarity in their execution, with the ultimate goal of bringing those risks down to an acceptable level as defined by the organization's risk tolerance.

Establishing a control inventory is a *result* of documenting controls, not the primary purpose of creating the procedures themselves.

Documenting procedures certainly helps increase the likelihood of effective control operation, but this is a means to an end; the ultimate end is managing risk to acceptable levels.