A department stores regulated data in an unapproved SaaS tool. What is the most appropriate audit focus?

1. Whether governance identifies the service and manages its data, supplier, and access risks
2. Only whether the subscription price was discounted
3. Immediate acceptance because users report higher productivity
4. Whether the tool's interface resembles an approved product