Watch this video on YouTube
A security control assessor finds that a control has been implemented differently than described in the security plan. The assessor determines that the alternative implementation provides equal or better security. What should the assessor do?