A CISA reviewing a client's organization's risk strategy would be most interested in? Question 9 options: 1) All risk is mitigated effectively 2) Residual risk is zero after control implementation 3) All likely risk is identified and ranked 4) The organization uses an established risk framework