When assessing the adequacy of a risk mitigation strategy, an internal auditor should consider which of the following?

1) Management’s tolerance for specific risks.

2) The cost versus benefit of implementing a control.

3) Whether a control can mitigate multiple risks.

4) The ability to test the effectiveness of the control.