An auditor uses attribute sampling to test internal controls. The auditor establishes a tolerable deviation rate of 5%. The sample results indicate a sample deviation rate of 3% and an allowance for sampling risk of 3%. The auditor should conclude:

The control is operating effectively because the sample rate (3%) is less than the tolerable rate (5%).

The control cannot be relied upon because the upper deviation rate exceeds the tolerable rate.

The sample size should be increased to reduce the allowance for sampling risk.

The control is effective because the allowance for sampling risk is within acceptable limits.