A treatment depends on a third party completing work, but no dependency milestone is tracked. What should be added?

1. Only the supplier's annual revenue
2. A note that all external work is outside risk management
3. An accountable dependency owner, agreed dates, monitoring, and contingency
4. A promise to assume completion until told otherwise