A risk practitioner receives evidence that a compensating control covers only half the affected systems. What should be done?

1. Assign the same reduction factor to every system
2. Remove uncovered systems from scope without justification
3. Close the risk because some systems are protected
4. Reassess residual risk using actual coverage and address the remaining gap