A New CISO Just Started with a Company and on the CISO's

A new CISO just started with a company and on the CISO's desk is the last complete Information Security Management audit report. The audit report is over two years old. After reading it, what should be your first priority?

A) Review the recommendations and follow up to see if audit implemented the changes
B) Meet with audit team to determine a timeline for corrections
C) Have internal audit conduct another audit to see what has changed.
D) Contract with an external audit company to conduct an unbiased audit