A control is documented as enabled, but tests show it fails for one production path. What should residual-risk analysis use?

1. The number of staff trained on the product only
2. The actual coverage and demonstrated effectiveness
3. The vendor's maximum advertised performance
4. The control's design description as conclusive evidence