Well I am not a PMP yet, but I can tell you if it was an unidentified risk then it won't be in risk register yet. hence no mitigation plan is available.
Since it impacts the iron triangle (scope, cost, schedule), it has to be immediately communicated to stakeholder.
Question is how it should be communicated and to whom?
Additionally these are realized risk not issues, which makes option 4 a better bet.
I think post risk review meetings, the issues and potential risks will make their way to issue log and risk register respectively (back to identify risk!)
www.pmi.org/learning/library/explaining-...ct-stakeholders-2206