An operations team applies emergency changes during an outage. Which control is still expected?

1. Permanent exemption of all emergency changes from review
2. Automatic approval of all future changes by the same developer
3. A requirement to delete the incident timeline after service restoration
4. Documented emergency authorization, traceability, and timely subsequent review