A control exception is justified by a business benefit that has since disappeared. What should the practitioner do?

1. Remove all controls in the process
2. Trigger reassessment of the exception and retained risk
3. Keep it indefinitely because it was approved once
4. Declare the risk transferred to the former sponsor