The GAO standards of reporting for governmental financial audits incorporate the AICPA standards of reporting and prescribe supplemental standards to satisfy the unique needs of governmental audits. Which of the following is a supplemental reporting standard for audits in accordance with Government Auditing Standards?

• Instances of abuse, fraud, mismanagement, and waste should be reported to the organization with legal oversight authority over the entity audited.

• All privileged and confidential information discovered should be reported to the senior officials of the organization that arranged for the audit.

• Material indications of illegal acts should be reported in a document with distribution restricted to senior officials of the entity audited.

• Reports on compliance with laws and regulations and internal control.