A merger introduces overlapping privileged accounts in two directories. What should the risk assessment consider?

1. Only the count of accounts in the smaller directory
2. A rule that directory integration always reduces risk
3. Combined access paths, conflicting duties, and integration dependencies
4. Only the original pre-merger approval records