An Audit Identified a Number of Weaknesses in the Configuration

An audit identified a number of weaknesses in the configuration of a critical client/server system. Although some of the weaknesses were corrected prior to the issuance of the audit report, correction of the rest will require between 6 and 18 months for completion. Consequently, management has developed a detailed action plan, with anticipated completion dates, for addressing the weaknesses. What is the most appropriate course of action for the chief audit executive to take?

A) Assess the status of corrective action during a follow-up audit engagement after the action plan has been completed.
B) Assess the effectiveness of corrections by reviewing statistics related to unplanned system outages, and denials of service.
C) Reassign information systems auditors to assist in implementing management's action plan.
D) Evaluate the ability of the action plan to correct the weaknesses and monitor key dates and deliverables.