A mitigating control for a high-risk payment process was implemented 18 months ago and initially reduced residual risk to within appetite. During a recent quarterly review, the risk practitioner notices that the number of manual override transactions has steadily increased and now exceeds the control's assumed operating baseline. No control failures have been formally reported. What should the risk practitioner do FIRST?