An auditor reviews a spreadsheet used to calculate material customer charges. What is the appropriate approach?

1. Assess change control, input validation, access, and independent checking according to business risk
2. Assume password protection alone validates every formula
3. Move it to a shared drive and consider all risk eliminated
4. Exclude it because only packaged applications can be audited