A CISO Sees Abnormally High Volumes of Exceptions to Security

A CISO sees abnormally high volumes of exceptions to security requirements and constant pressure from business units to change security processes. Which of the following represents the MOST LIKELY cause of this situation?

A) Poor audit support for the security program
B) A lack of executive presence within the security program
C) Poor alignment of the security program to business needs
D) This is normal since business units typically resist security requirements