A Recent Audit Has Identified a Few Control Exceptions and Is

A recent audit has identified a few control exceptions and is recommending the implementation of technology and processes to address the finding. Which of the following is the MOST likely reason for the organization to reject the implementation of the recommended technology and processes?

A) The organization has purchased cyber insurance
B) The risk tolerance of the organization permits this risk
C) The CIO of the organization disagrees with the finding
D) The auditors have not followed proper auditing processes