An auditor is using attribute sampling to test the operating effectiveness of a control. The auditor specifies a tolerable deviation rate of 5%. The sample of 100 items yields 2 deviations. The calculated upper deviation rate at the 95% confidence level is 6.2%. What is the auditor's MOST appropriate conclusion?

The control is operating effectively because the sample deviation rate (2%) is less than the tolerable rate (5%).

The control cannot be relied upon as planned because the upper deviation rate exceeds the tolerable deviation rate.

The auditor should increase the sample size to reduce the upper deviation rate to 5%.

The control is effective because the allowance for sampling risk is only 1.2%.