What should a risk practitioner do NEXT if an ineffective key control is identified on a critical system?