A system owner wants to accept a high residual risk outside delegated tolerance. What should the security manager do?

1. Close the risk because the owner acknowledged it
2. Treat the existence of a compensating control as automatic acceptance
3. Accept it personally to keep the schedule
4. Escalate to the authority authorized to accept that risk