A supplier's audit report covers corporate offices but not the hosted service purchased by the organization. What should the manager do?

1. Obtain an additional copy of the same office-only report
2. Use the supplier's corporate risk rating as a substitute for service evidence
3. Accept it because the supplier name matches
4. Seek assurance covering the relevant service and period