A privileged employee transfers to a different role but retains old access. Which process should be strengthened?

1. Increase password rotation frequency for the employee's existing accounts
2. Only annual password length review
3. Add the employee to every access-review distribution list
4. Joiner-mover-leaver access governance