An Audit Identified a Number of Weaknesses in the Configuration

An audit identified a number of weaknesses in the configuration of a critical client/server system. Although some of the weaknesses were corrected prior to the issuance of the audit report, correction of the rest will require between six and 18 months for completion. Consequently, management has developed a detailed action plan, with anticipated completion dates, for addressing the weaknesses. Which of the following is the most appropriate course of action for the chief audit executive to take?

A) Assess the adequacy of the action plan and monitor key dates and deliverables.
B) Schedule a follow-up audit engagement to assess the status of corrective action.
C) Reassign information systems auditors to assist the information technology department in correcting the weaknesses.
D) Evaluate statistics related to unplanned system outages, unauthorized access attempts, and denials of service to assess the effectiveness of corrections.