A business wants faster onboarding, but a proposed control adds a week to every application. How should the practitioner frame the decision?

1. Recommend the slowest process because more delay always means more security
2. Compare control effectiveness and alternatives against both risk and business objectives
3. Approve removal solely because the control is inconvenient
4. Ask the supplier to define the company's risk appetite