What Is the PRIMARY Purpose for an Organization to Conduct

What is the PRIMARY purpose for an organization to conduct a security audit?

A) To ensure the organization is adhering to a well-defined standard
B) To ensure the organization is applying security controls to mitigate identified risks
C) To ensure the organization is configuring information systems efficiently
D) To ensure the organization is documenting findings