A company outsources IT operations but retains ownership of business information. What should its governance framework make clear?

1. Outsourcing execution does not remove the company's accountability for managing associated risk
2. The internal audit function must operate the supplier's daily controls
3. No service-level or security monitoring is needed after contract signature
4. The supplier assumes every legal and business obligation without qualification