An access review is completed by approving every entitlement without checking current duties. What should the practitioner conclude?

1. Completion is not reliable evidence that the control operated effectively
2. The number of reviewers alone determines effectiveness
3. The control is effective because every box is checked
4. The review must be replaced with no access governance