A control owner's self-report conflicts with independent test evidence. How should governance respond?

1. Always accept the owner's statement because they operate it
2. Investigate the discrepancy and base the decision on validated evidence
3. Average the two conclusions without analysis
4. Always reject all self-assessments permanently