A proposed control reduces risk substantially but leaves residual exposure above approved tolerance. What is the best recommendation?

1. Hide the residual estimate
2. Let the installer accept the business risk automatically
3. Evaluate additional treatment or escalate for an authorized decision
4. Declare success because any reduction is sufficient