The information security manager discovers that a business owner has accepted a high risk without formal approval. What should be done?

1. AIgnore it, because the owner has already decided
2. BAccept the risk formally on the owner's behalf
3. CRemove the owner's access to the system at once
4. DEscalate according to the risk acceptance process