Which of the following statements is correct concerning an auditor’s responsibility for controlling the distribution by the client of a restricted-use report?

  1. An auditor must inform the client that a restricted-use report is not intended for distribution to non-specified parties.
  2. When an auditor is aware that a client has distributed a restricted-use report to inappropriate third parties, the auditor should immediately inform the client to cease and desist.
  3. An auditor controls distribution through insisting that the client not duplicate the restricted-use report for any purposes.
  4. An auditor is not responsible for controlling the distribution of such reports.