According to IIA guidance, which of the following corporate social responsibility (CSR) evaluation activities may be performed by the internal audit activity?

1) Consult on CSR program design and implementation.

2) Serve as an advisor on CSR governance and risk management.

3) Review third parties for contractual compliance with CSR terms.

4) Identify and mitigate risks to help meet the CSR program objectives.