A detective control produces findings, but no team is responsible for responding. What is the key gap?

1. The findings prove the risk has been avoided
2. The metric must be renamed preventive
3. The organization needs more identical alerts before assigning an owner
4. The control-to-response workflow lacks accountability