The five legitimate 'no change' decisions: no-action, monitor, defer, transfer, and risk acceptance