A business executive accepts a residual security risk outside their delegated authority. What should the security manager do?

1. Delete the assessment to prevent disagreement
2. Accept the risk personally instead
3. Escalate through the approved risk-governance process
4. Treat the signature as sufficient regardless of authority