A business unit repeatedly bypasses approval because the control is incompatible with its service model. What should the manager do first?

1. Remove the policy without authorization
2. Demand identical implementation without examining constraints
3. Understand the business need and evaluate a compliant, risk-appropriate control design
4. Ignore the bypass because revenue is strong