A risk rating decreases after a control purchase, although implementation has not begun. What should the practitioner challenge?

1. Whether the purchase invoice has enough detail
2. The business owner's interest in treatment
3. Whether the reduction is supported by operating protection
4. The need to record the planned control