A business owner accepts residual risk within authority. What should the security manager ensure next?

1. Transfer ownership to the external auditor
2. Documented rationale, monitoring, and reassessment conditions
3. Delete all related monitoring
4. Treat acceptance as permanent regardless of business changes