A process owner accepts a low residual risk within delegated authority. What should the practitioner ensure?

1. That the auditor becomes the new owner
2. That all controls related to the process are removed
3. That acceptance is described as guaranteed safety
4. The rationale, owner, conditions, and monitoring are documented