A risk scenario assumes employees will report fraud promptly, but the reporting channel is anonymous only in policy and not in practice. What is the concern?

1. The fraud loss is necessarily zero
2. Every employee must be considered malicious
3. The channel's existence proves effectiveness
4. A key behavioral and control assumption may be invalid