A risk report includes no changes since the previous month even though a critical supplier failed. What should be updated?

1. Only the report publication date
2. The supplier's name only
3. The scenario, current exposure, treatment status, and relevant decisions
4. Nothing until a formal audit finding exists