The organization claims compliance proves its security risk is acceptable. What should the security manager explain?

1. Compliant organizations cannot suffer incidents
2. Compliance is one requirement; risk assessment must also address relevant business exposure
3. Risk assessment is unnecessary after an audit
4. Compliance and risk are identical in every context