A company has completed the implementation of Technical and management controls as required by its adopted security policies and standards. The implementation took two years and consumed all the budget approved to security projects. The board has denied any further request for additional budget. Which of the following should a company do to address the residual risk?

1. Transfer the risk

2. Baseline the risk

3. accept the risk

4. remove the risk