Auditors request proof of who approved privileged access and what administrative actions followed. Which approach best fits?

1. Assess customer controls and obligations against the applicable requirements.
2. Map data-residency requirements to service locations, replication, backups, and processing behavior.
3. Retain approval records and appropriately protected audit evidence.
4. Document risk ownership, compensating controls, approval, and an expiry date.