A treatment is marked implemented, but the risk owner has not reviewed the resulting residual exposure. What remains necessary?

1. A new invoice from the same supplier
2. An authorized decision on the verified residual risk
3. Deletion of the original impact estimate
4. Automatic transfer of all future exposure to the project manager