A business unit reports that a prior high-risk finding is closed. What should establish closure?

1. Follow-up evidence that corrective action addresses the identified risk
2. A new target date in the action tracker
3. The original finding's age
4. An undocumented statement from the control owner