An audit discovers a customer control required by its provider's assurance report was never implemented. What is the best response?

1. Ask the auditor to operate the missing control indefinitely
2. Declare the provider's report invalid for every other customer
3. Record compliance because the provider passed its own audit
4. Assess exposure, assign an owner, and remediate the missing customer control