A business process changed from daily batch settlement to real-time settlement. What risk assumption most clearly needs review?

1. A rule that real-time services cannot use compensating controls
2. Only the original software purchase price
3. The effect of interruption and the required timing of controls and recovery
4. Only the age of the previous risk report