A business owner accepts a documented IT risk that exceeds their delegated authority. What should an auditor expect?

1. Automatic acceptance because the owner wrote the risk description
2. Escalation to the designated authority under the risk governance process
3. The auditor's signature replacing the business decision
4. Deletion of the risk to bring the register below tolerance