An assessment concludes that residual risk is acceptable but never states the applicable tolerance. What is missing?

1. Only the assessor's certification number
2. A guarantee that risk cannot change
3. The exact brand of every control
4. A documented comparison with approved acceptance criteria