OOB Attestation frequency used to be at the Profile level; in Madrid, it's at the Control level, which makes much more sense. Non-compliance, whether from a failed indicator or a non-compliant attestation, always creates an Issue, which should be used to resolve compliance issues.

Many of my clients have judged the use of manual indicators to be duplicative of attestations, since you're asking someone to provide evidence that they comply with the control, and less objective, since the indicator owner has to provide the response, and have elected not to use them.