Watch this video on YouTube
An assessment of information security controls has identified ineffective controls. Which of the following should be the risk practitioner's FIRST course of action?