A risk policy was approved five years ago and has not changed after major acquisitions. What should the practitioner recommend?

1. Review its continued alignment with business scope, obligations, and governance
2. Replace it solely with the newest vendor template
3. Suspend all business operations until every policy sentence is rewritten
4. Retain it automatically because it once passed an audit