An auditor is evaluating the results of attribute sampling performed on a population of 2,000 purchase orders to test the authorization control. The sample size was 100. The auditor found 2 deviations. The calculated upper deviation rate at a 95% confidence level is 6.3%. The tolerable deviation rate established during planning was 7%. What is the auditor's MOST appropriate conclusion?

The control is operating effectively because the upper deviation rate (6.3%) is less than the tolerable deviation rate (7%).

The control is not operating effectively because the sample deviation rate (2%) is less than the tolerable rate, but sampling risk is too high.

The auditor should increase the sample size because the upper deviation rate is close to the tolerable rate.

The control is not operating effectively because the allowance for sampling risk (4.3%) is too large.