An audit sample contains several unapproved production changes. What is the best next audit response?

1. Immediately conclude that every production change was unauthorized
2. Ignore them because the majority of sampled changes were approved
3. Ask operations to erase the exception records before report issuance
4. Assess the exceptions' cause and impact and expand testing when justified