A team reports inherent and residual risk as identical without evaluating existing controls. What should the manager question?

1. Whether all risks were accepted by the same committee
2. Whether control effectiveness has been incorporated appropriately
3. Whether the spreadsheet has enough colors
4. Whether the risk register includes enough separately named control categories