A risk treatment is judged successful solely because it complied with the implementation schedule. What additional evidence is needed?

1. Demonstrated achievement of the intended control outcome and residual-risk target
2. Only confirmation that the project manager was satisfied
3. Only a count of project meetings
4. Only a final supplier invoice