A risk treatment is complete, but no one has tested whether the control works. What is the most important next step?

1. Accept the vendor's installation date as the risk score
2. Close the risk because an invoice was paid
3. Validate effectiveness before concluding residual risk meets the target
4. Delete the original risk description