An IT auditor discovers that the configuration settings or passward controls are more stringent for business users than for network administrators. Which of the following is best action for the IT auditor to take

$1)$ Document that this is a policy violation

$2)$ Recommend that all security settings be identical

$3)$ Recommend that logs of all user access be monitored periodically $4)$ Recommend that network administrator settings be more stringent