Management wants independent assurance of a control assessment. Which arrangement best supports this?

1. The implementer approving their own work exclusively
2. Untrained reviewers selected only for availability
3. Assessors with appropriate competence and independence
4. A vendor statement without evidence