A control tests well in one application but is deployed differently across the enterprise. What should assurance consider?

1. The first application's result as conclusive enterprise evidence
2. Only the installation contract's page count
3. Configuration and operating differences across the actual scope
4. Only the product's shared name