Control Risk x Inherent Risk = Risk of material misstatement. Therefore, if there are significant deficiencies in the controls testing noted as in the case of this question, the auditor needs to increase the assessed level of control risk. Because of the increased assessed level of control risk, the auditor should do more substantive testing/detail testing to accommodate for the higher control risk. If the client's controls were operating more effectively, then the auditor could rely more on the controls testing and could therefore do less substantive testing (i.e. assess the control risk as lower).
In summary:
Higher control risk (deficiencies noted in control testing) = more substantive testing required
Lower control risk (controls testing noted no deficiencies) = less substantive testing required (Can rely on controls testing)