When evaluating an attributes sample, why is the focus on the upper limit of deviations in the sample? If the upper limit of deviation exceeds the tolerable deviation rate in attributes sampling, what alternative courses of action are available to the auditor?