A risk owner chooses a temporary compensating control while a permanent fix is developed. What should the manager require?

1. Immediate deletion of the permanent-fix plan
2. A statement that all compensating controls are equivalent
3. A permanent exception with no review date
4. Evidence of coverage, accountable ownership, expiry, and a tracked permanent treatment