Which of the following statements correctly describes the relationship between 'Significant Risks' and internal control testing?

Controls over significant risks can be tested every third year (rotational testing).

If the auditor plans to rely on controls over a significant risk, those controls must be tested in the current period.

Significant risks must always be addressed by substantive procedures alone; control testing is not permitted.

Inquiry and observation are sufficient to test controls over significant risks.