Four: data exposure when company or client information is entered into unassessed tools, regulatory exposure because you remain the controller for that processing, unreliable output reaching clients unchecked, and the absence of an audit trail, which makes the first three difficult to prove either way.
